Three weeks after attackers cooked the coolers in roughly 700 French supermarkets, they did it again. This time the target was a continent.
Over the weekend, refrigerators and freezers in dozens of supermarkets across seven European countries were forced into defrost mode, with temperatures reportedly reaching 50°C (122°F). The method matched October's. The warning had already gone out. It didn't matter.
One correction to how this is being framed: this wave was wider, not bigger. France lost about 700 stores in one night. This round hit dozens of sites, but across seven countries. The real story is that the attack came back through the same door after everyone had been warned.
Where it hit
Belgium and Luxembourg: About 40 Delhaize supermarkets. One Delhaize store in Hoeilaart reported €100,000 in lost produce, not counting closure losses. Carrefour reported 15 of its more than 700 Belgian stores, and Colruyt's franchised Spar network five. Ikea's store in Mons was also hit.
Sweden: Six or seven Coop stores, depending on the report, plus a small number of ICA stores operating outside ICA's central network. One ICA store in Sjöbo posted that its fridges and freezers had been hacked and set to 50 degrees.
Ireland: 13 SuperValu supermarkets, limited to a specific refrigerator model.
Netherlands: Danfoss told Dutch broadcaster NOS that systems at no fewer than 17 companies were hit, mostly butchers and small neighborhood shops.
Finland: Malfunctions at some Kesko K-stores, now under investigation.
Estonia: One Selver outlet. Kitman Coldtech, an Estonian refrigeration technology maker, said attackers reached a client's control computer and set it to 50°C. Its team caught it within minutes, with no significant damage.
Attribution is still unknown. Belgian and Swedish cyber agencies are monitoring. The UK's National Cyber Security Centre is working with partners, with no UK incidents reported yet.
Why the fixes didn't hold
The most important detail came from Stephan Moelans, CEO of Sabcobel, which manufactures some affected units and runs Delhaize's systems. He told Belga his company had been protecting customers since the French attack, but the units needed physical modifications, not just software updates. Most customers moved to secure connections after France. Not all did.
That changes the remediation model. A patch can go out overnight. A hardware fix requires a technician at every store. Three weeks wasn't enough, and the attackers seemed to know it.
Who got hit tells you how they're hunting
Look at the victim list. ICA stores outside the central network. Franchised Spar shops. Dutch butchers. A single Ikea store. The big, centrally managed fleets mostly held. The edges didn't.
These attackers appear to be scanning for exposed controllers, not picking brands. Any business with a cold case and a remote-access link is in scope. That includes restaurants, pharmacies, florists, labs, and hospitals.
More vendors, same play
October named Danfoss, Copeland, and Dixell. November adds Sabcobel in Belgium and Kitman Coldtech in Estonia. Five manufacturers, one technique: get into the controller and command a defrost or setpoint change.
This isn't a single bad product. It's a design pattern the whole industry shipped: remote setpoint control with weak access protection.
The U.S. thread tightens
Last month I flagged the August refrigeration failures at U.S. military commissaries as a possible link and urged caution. The BBC now reports that U.S. authorities are working with French officials to determine whether those incidents could be connected. That's not attribution, but it moves the theory from speculation to an active joint investigation.
If they are linked, the timeline reads like a campaign. U.S. bases in August. France in October. Seven more countries in November.
Steelman: is this just copycats?
Possibly. The French attack was heavily publicized, the vulnerable models were named, and Claroty's research had been public since August. A second actor could have scanned for the same exposure. Smaller store counts and scattered targets fit opportunists as well as a coordinated campaign.
The damage also stayed at the shelf. Delhaize said its distribution centers ran normally and store deliveries continued. This round hit inventory, not the supply chain. That cuts against the food-security framing, for now.
But copycats don't reduce the risk for defenders. They change it. One capable actor is a threat. A technique anyone can repeat is a permanent condition.
What leaders should take from round two
Disclosure starts a countdown. Once a vulnerable model is named publicly, every unremediated unit becomes a target within days.
Hardware fixes need a deadline, not a roadmap. If a fix needs a site visit, take the controller offline until the technician arrives. Running a known-vulnerable unit "until the fix" is the exact window attackers used.
Franchises and independents are your exposure. Central IT can't secure what it doesn't manage. Brand-level security programs must reach franchise and independent operators, or the brand absorbs the damage anyway.
Small businesses need a playbook. Butchers and corner stores don't have a security operations center. Industry groups and refrigeration contractors should push simple guidance now: disconnect remote access, add a standalone temperature alarm, call your installer.
Plan for the third wave. Twice in three weeks is a pattern. Assume another attempt and test your response before it arrives.
Minutes beat mornings. The Estonian vendor caught its intrusion within minutes and avoided real damage. Stores without live temperature alerting discovered the loss at opening. The cheapest control on this list is an alarm someone actually answers at 2 a.m.
The board question, round three
Last month the question was who owns this risk. Then it was how many controllers run unsupported firmware. Now it's this: if our remediation needs hardware, which stores are still exposed tonight, and why are those controllers still online?
Sources:
BBC News, "Shop freezers in seven European countries hit by cyber-attack," James Gregory, November 2, 2026
