CommandEleven Intelligence // Europe Desk. Flash Assessment, status as of November 2, 2026. This is a developing incident. Most of what follows is company and press reporting from the first day, and we say where it conflicts. We are not scoring calls on this one. It is a data point on the French case we are already watching.
Bottom Line Up Front
Overnight into Monday, November 2, refrigeration systems were tampered with at supermarkets in Sweden, Belgium, Luxembourg and Estonia. Ahold Delhaize confirmed that cooling settings at its stores were changed. ICA and Coop in Sweden confirmed incidents. Delhaize’s refrigeration operator in Belgium says evaporators were switched to defrost mode, which matches the method reported in France in October. No group has claimed it, no vendor has been confirmed, and no authority has attributed it.
The open question is the one that matters: whose controllers were these? France was traced to Danfoss regulators running outdated firmware. If the new units are Danfoss, the French finding extends: a known technical weakness is still being used against unpatched equipment. If they are another vendor, or a shared remote-access provider, the problem is wider than one product. Danfoss says no link to its products has been established. Our assessment is that this is more likely a technical exposure than a coordinated political campaign, but we do not have the evidence to say which, and we do not rule out a common actor.
Key Judgments
KJ1: Refrigeration settings were changed remotely at stores in at least four countries on November 2. Delhaize confirmed changed cooling settings and called it an IT incident. ICA’s head office confirmed an overnight incident at a limited number of stores. Coop confirmed incidents at six stores in central Sweden. An Estonian chain was also hit, according to Reuters. [CONFIRMED that incidents occurred; REPORTED on scale]
KJ2: The method looks the same as France. In France, BFM TV reported attackers triggered forced defrosting. In Belgium, the head of Sabcobel, which operates Delhaize’s refrigeration, told Belga that evaporators were switched to defrost mode. Both fit a single command abused at scale. [REPORTED; ASSESSED on the match]
KJ3: No vendor is confirmed in any of the new cases. Danfoss says no link has been established between these incidents and its products. Reports name Sabcobel as the Delhaize operator and Kitman Coldtech as the Estonian supplier. Neither has said whose controllers were used. [UNVERIFIED]
KJ4: The French case is a technical weakness, not yet a campaign. French officials said the national cybersecurity agency ANSSI found a flaw in Danfoss software, and Danfoss said the affected units ran outdated firmware or no longer received updates. No actor has been named. [REPORTED]
KJ5: The attack path may be a provider or an exposed interface, not the retailers’ own networks. ICA says the affected systems were connected separately from its central network. Delhaize disconnected its refrigeration systems from the internet after the incident. Sweden’s cybersecurity centre says many exposed operational technology devices in the country need patching. These points are consistent with exposed remote access. They do not show it. [ASSESSED, low confidence]
KJ6: We see no sign of a link to the French protests, and no evidence of a state hand. We found nothing in the reporting that connects the incidents to unrest, and no attribution of any kind. [UNVERIFIED]
What Is Reported, Country by Country
Sweden
- ICA. The head office confirmed an overnight incident hitting refrigeration and freezer systems at a limited number of stores. Store managers in Sjöbo and Sankt Olof in Skåne described food losses. The Sjöbo manager put the temperature above 50°C. A manager in Böda on Öland reported a freezer at 55°C. ICA says the systems were connected independently of its central network. [REPORTED]
- Coop. Six stores in central Sweden, per the Swedish broadcaster SVT and Reuters. Coop did not itself call it hacking. One outlet reports seven of about 800 stores. We use six. [REPORTED; counts differ]
- Authorities. The National Cybersecurity Centre, part of FRA, is assisting. Its director, John Billow, said it is working on several incidents and that many exposed operational technology devices in Sweden need updating. No actor, malware or entry method has been identified. [REPORTED]
Belgium and Luxembourg
- Delhaize. Spokesperson Sarah De Meester confirmed that cooling temperature settings were changed, found overnight and under investigation. Store managers were reportedly alerted by text at about 4 a.m. The company called it an IT incident and disconnected its refrigeration systems from the internet. Local media put the number at about 40 stores in Flanders and Wallonia, with some in Luxembourg. The count is not an official figure. [REPORTED]
- Others. About 15 Carrefour stores and five independent Spar stores supplied by Colruyt were reported in Belgian media. [REPORTED; single-source]
- Temperatures conflict. RTL Info reports rises to about 15°C, mostly in freezers. Other outlets report 50°C or more. We do not have a figure we trust. [DISPUTED]
- The operator. Sabcobel runs Delhaize’s refrigeration systems. Its CEO, Stephan Moelans, told Belga it was a cyberattack and that evaporators were switched to defrost. His office declined further comment to Reuters. [REPORTED]
Estonia
Reuters reports an unnamed Estonian supermarket chain was hit the same morning, with some units set to 50°C. The chain’s technology supplier, Kitman Coldtech, said the incident happened that morning. We found no store count and no further detail. [REPORTED; single-source]
The Danfoss Question
France is the baseline. ANSSI identified a flaw in Danfoss software, and Danfoss told reporters that the units hit were legacy products, naming its AK-SM800 and AK-SC355 regulators, that no longer receive security updates, or ran outdated firmware. A research firm, Claroty, had published Danfoss controller vulnerabilities on August 9, and Danfoss says it has patched them. Intermarché’s chief executive estimated losses of tens of millions of euros in a single day. [REPORTED]
What each answer would mean, on our reading. [ASSESSED]
- The units are Danfoss and unpatched. This extends the French finding. It says a known, fixable weakness is being used again against equipment that was not updated, and that someone is scanning for it. It points to a scalable technical exploit. It would not by itself show a single actor.
- The units are a different vendor. This is the bigger change. It would mean the weakness is not one product’s bug but a class of refrigeration management systems left reachable from the internet, or a shared way in. Neither France’s Danfoss finding nor the Danfoss denial would explain it.
- The units share a service provider or remote-access tool, not a vendor. The two named parties, Sabcobel in Belgium and Kitman in Estonia, run or supply refrigeration for multiple stores. A compromise at the provider would explain how many stores in one chain were changed within hours, and why Delhaize disconnected its systems from the internet. We have no evidence for this, and we flag it as a possibility to test.
- It stays unknown for some time. In France the vendor was named within days, but no actor has been named three weeks on. We expect the actor question to stay open here too.
A correction to the framing we started with. The French case already points to a technical weakness, so Danfoss in these incidents would confirm that read in the new countries. A different vendor or a common provider would change it.
What We Do Not Know
- Who is behind it. No group has claimed it and no authority has named anyone.
- How access was gained in any of the new cases.
- Whose controllers were affected, and whether any are Danfoss.
- Whether the Delhaize incident is linked to the cyber incident Ahold Delhaize reported to Dutch police in October. Delhaize told Dutch broadcaster NOS it is checking.
- The real scale. Store counts come from local media, and the temperature figures conflict.
RTL Z found 57 Dutch refrigeration systems that could be reached in the same way during October, according to DutchNews. That is a sign of exposure, not of an attack in the Netherlands.
What to Watch
- A vendor named. Danfoss, Sabcobel, Kitman, Copeland or another. This is the single fact that decides the read.
- An authority attribution. ANSSI, Sweden’s NCSC, Belgium’s Centre for Cybersecurity or Europol naming an actor or a shared entry point.
- A claim of responsibility. None so far. Treat any claim as unverified until a vendor or authority corroborates it.
- More countries. Spain, Portugal, Poland and Germany were mentioned in reporting on the French wave. A new country with the same pattern would favor a scalable technical exploit.
- A link to the Dutch October incident. A confirmed link at Ahold Delhaize would connect Belgium to an earlier intrusion.
- Patch and advisory activity. A new vendor advisory or emergency patch would suggest the exposure is still open.
What This Assessment Does and Doesn’t Establish
It establishes that retailers confirmed overnight refrigeration incidents on November 2 in Sweden and at Delhaize in Belgium and Luxembourg, that an Estonian chain was reportedly hit, and that two operators described the Belgian method as defrost-mode switching. It does not establish a cause, a vendor, an actor, the real number of stores or any link to France. Several details rest on one outlet. We could not retrieve the SVT, Aftonbladet or Belga reports and read them through secondary coverage. Nothing here is entered in the Foresight Record.
Frequently Asked Questions
Were supermarket fridges hacked in Sweden and Belgium?
Retailers confirm that refrigeration settings were changed or disrupted overnight into November 2. Delhaize confirmed changed cooling settings. ICA confirmed an incident. Whether it was a cyberattack is the working assumption of the operators, not yet a finding of investigators.
Is this connected to the French supermarket attack?
It looks similar, with the same reported defrost method, but no link is established. Danfoss says there is none to its products.
Who is responsible?
Unknown. No group has claimed responsibility and no authority has attributed the incidents.
Why does a fridge need an internet connection?
Retailers connect refrigeration controllers so they can monitor temperatures and manage stores from a distance. That remote access is also the exposure. Many of these systems are old and no longer receive security updates.
Is food safe to buy?
Stores discarded affected stock, and some closed. The reports describe losses at the stores and do not describe food reaching shoppers. Follow your retailer’s and national food-safety authority’s guidance.
Sources
- Copenhagen Post (Ritzau), Supermarket refrigeration systems targeted in three European countries (November 2, 2026; ICA, Coop and Ahold Delhaize statements)
- DutchNews, Albert Heijn sister chain hit as fridge hacks spread in Europe (November 2, 2026)
- ThePrint (Reuters), European supermarkets hit by new fridge cyber attack (November 2, 2026; syndicated, auto-generated from Reuters)
- GBHackers, Hackers Target Supermarket Refrigeration Systems Across Sweden, Raising Freezer Temperatures to 55°C (secondary; store-level accounts)
- Brussels Morning, Hackers Hit Freezers Overheating 55C in Sweden Belgium 2026 (secondary; Danfoss statement and Belgian store counts)
- Euro Weekly News, Swedish supermarket hit by cyberattack as fridges remotely set to 50C (secondary; one date detail conflicts with the calendar)
- CBS News, Hackers turn up the heat in refrigerators at hundreds of supermarkets in France, sparking fires and food losses (France baseline)
- Al Jazeera, Hundreds of supermarkets in France hit by ‘unprecedented’ cyberattack (France baseline)
- Coffe Report on X, Refrigeration disruptions spread across Europe (aggregator post, November 2, 2026; used as a lead only)
