Freezer Cyber-Attack Hits 10 EU Nations & UK Meat Firms

A coordinated supermarket freezer cyber-attack struck at least 10 European countries from Estonia and Sweden to Portugal and Italy on 2 November 2026, forcing retailers to dump chilled and frozen food and reaching into the UK meat supply chain. Britain's National Cyber Security Centre (NCSC) confirmed it was working with affected businesses while assessing the national impact as minimal, describing the incidents as "the foothills of a wider threat."

What Happened: Freezer Temperatures Raised Across 10 European Countries

Retailers in Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden all reported refrigeration problems on Monday, with temperatures climbing as high as 50C (122F) in some units. The attacks followed a much larger October 2026 hack that hit hundreds of French supermarkets and caused tens of millions of euros in food losses. This time, attackers appear to have used the same playbook: remotely switching evaporators to defrost mode on internet-connected cooling systems, disabling alarms and leaving chilled goods to spoil overnight. In Belgium, around 40 Delhaize stores were affected, while SuperValu pulled chilled and frozen products from 13 Irish stores as a precaution. ICA Sweden confirmed hacked freezers, and an Ikea outlet in Mons, Belgium was among those hit.

Cold Chain Disruption Spreads

The cold chain cyber security failures highlight how dependent modern supermarkets are on remote refrigeration monitoring. Because the temperature changes often did not trigger alarms, many incidents were discovered only when staff arrived for morning shifts. Some Belgian stores reported losses of up to €100,000 each, while one Flemish retailer alone estimated €100,000 in discarded goods. France's Établissement français du sang also reported an attempt to heat blood plasma refrigerators to 110C, though staff intervened in time.

UK Meat Suppliers and the NCSC Response

The British Association of Independent Meat Suppliers (AIMS) said some of its 300-plus members were affected as "collateral damage." Two members saw fridges begin defrosting and another's cold units reached up to 100C (212F); the devices were empty, so no meat was lost. London fruit and vegetable wholesaler Langridge Organic stopped an attack by disconnecting its cold units from the internet. NCSC said it had worked overnight to alert at-risk organisations and that no UK grocery chain was directly hit. The agency's assessment echoed broader UK NCSC cyber guidance on vulnerable internet-connected industrial equipment.

How the Attack Worked: Legacy Controllers and Default Passwords

Cybersecurity researchers say the intrusions exploited widely used refrigeration controllers from Danfoss and Copeland that run web servers reachable over the public internet, often protected only by default credentials such as "admin" and the current date. The Belgian manufacturer Sabcobel said affected units needed physical modifications, not just software patches, to close the vulnerability. Lupovis researchers logged 256 attacks on fake Danfoss controller "honeypots" between 20 and 30 October, indicating automated scanning and exploitation at scale. These internet of things vulnerabilities have become a recurring entry point for disruptive operations.

Wider Implications: The Foothills of a Larger Threat

Security experts warn that the freezer hacks, while limited in immediate effect, could be reconnaissance for more damaging attacks on food supply chains and critical infrastructure. NCSC chief Richard Horne said it was too early to identify the culprits, but noted that outdated, internet-connected systems are easy targets and that adversaries are increasingly using artificial intelligence. Researchers have observed infrastructure overlaps with Russia-linked cyber operations, though no group has claimed responsibility. EU Commissioner Christophe Hansen called the attacks a deliberate attempt to disrupt food supplies. The incidents follow a broader pattern of disruptive cyber operations against commercial infrastructure, including suspected August 2026 malfunctions at US military base commissary freezers.

FAQ: Supermarket Freezer Cyber-Attack

What is a supermarket freezer cyber-attack?

A supermarket freezer cyber-attack is a remote intrusion into internet-connected refrigeration controllers that raises temperatures, triggering defrost cycles and spoiling chilled or frozen food without setting off alarms.

Which countries were affected?

At least 10 European countries were hit, including Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden, plus the UK food supply chain.

Did the UK lose any meat?

No. UK meat suppliers reported defrosting fridges and units reaching 100C, but the affected devices were empty, so no produce was lost. The NCSC assessed the national impact as minimal.

How can supermarkets prevent freezer hacks?

Retailers should disconnect non-essential devices from the public internet, change default passwords, apply firmware updates and monitor for unusual temperature changes. Organisations can also follow food supply chain disruption guidance from national cyber agencies.

Conclusion and Future Outlook

As regulators and retailers assess the damage, the attacks serve as a stark reminder that operational technology remains a soft underbelly of modern logistics. With no culprit identified and automated scanning continuing, European food retailers and cold chain operators are likely to face further attempts in the weeks ahead.