Supermarket fridges and freezers overheated in nine European countries — up to 50°C, food thrown away, in a suspected cyber-attack
Supermarket chains in nine European countries — Belgium, Estonia, Ireland, Finland, Italy, Luxembourg, the Netherlands, Portugal and Sweden — reported that temperatures in some of their fridges and freezers soared overnight into Monday, to as high as 50°C, forcing stores to throw away spoiled food, AFP reports in its full account of Monday's wave, read in this pass. The two countries new since the first reports are Italy — at least four Coop supermarkets in Sicily and one business in Tuscany — and Portugal, where the Mosqueteiros group confirmed incidents at seven Intermarché stores; Ireland's Musgrave said 13 SuperValu stores were hit. The EU's agriculture and food commissioner, Christophe Hansen, called the incidents a deliberate attempt to disrupt the bloc's food supply chain and undermine consumer confidence, and Belgian federal prosecutors have opened an investigation. No group has claimed responsibility for either this wave or October's attack on French supermarkets, and no authority has named an attacker.
Checking in progress
This story is still being checked. Claims below are published as claims — never dressed as facts — and each one moves only when the evidence earns it.
- Collecting reportsDone
- Grouping the versionsDone
- 3Checking claims5 of 7 claims checked
- 4Human gateStill to come
5 of 7 claims checked so far · step 3 of 4: Checking claims
Key points
- Nine countries overnight, on AFP's full account: Belgium, Estonia, Ireland, Finland, Italy, Luxembourg, the Netherlands, Portugal and Sweden — fridge and freezer temperatures up to 50°C, food thrown away. Italy and Portugal are new since the first seven-country reports, each confirmed by the retailers affected (Radenza/Coop in Sicily; Mosqueteiros/Intermarché in Portugal).
- Belgium was hit hardest: about 40 Delhaize stores plus Carrefour (~15), Spar (5) and Intermarché (15); Sabcobel says evaporators were switched into defrost mode and its technicians worked from 1 a.m. disconnecting units.
- It is a suspected attack, labelled as such on this page: retailers and Sabcobel say cyber-attack, Ahold Delhaize says 'IT incident', and no authority has named an attacker or confirmed one coordinated perpetrator — nobody has claimed responsibility.
- The precedent is France in October: up to 700 supermarkets, temperatures from −27°C to over 50°C, fires and tens of millions of euros in losses, a prosecutor's investigation — and no established link yet between the two waves.
- The EU's food commissioner, Christophe Hansen, calls the wave a deliberate attempt to disrupt the food supply chain; Belgian federal prosecutors have opened an investigation (AFP).
What happened
Modern supermarket refrigeration is run by controllers that can be monitored and adjusted over the internet — the same feature that lets a chain manage hundreds of stores from one screen lets an intruder who reaches a controller warm a freezer overnight. Experts quoted in the reporting say thousands of such controllers stayed reachable from the internet even after the French attack, and that the method is cheap, the damage immediate, and — with no ransom demand in either wave — the pattern looks like sabotage rather than extortion. Those are expert assessments, not official findings.
The losses land store by store: one Delhaize branch in Hoeilaart, Belgium, put its lost produce at about €100,000, and local reporting across the affected countries puts discarded food in the millions of euros in total, though no joint official loss figure exists yet. Monday's wave was smaller than France's — dozens of stores against up to 700 — and Monday's wave spread across nine countries in a single night, on AFP's fuller count.
Claim by claim
Why this label: The seven-country scope was verified at publish against the Guardian, the BBC and Reuters in agreement. The expansion to nine rests on AFP's full report (read in full in this pass via Punch Nigeria) — the wire account carried identically by other outlets, which the source ladder counts as one chain — strengthened for the two new countries by the retailers' own confirmations: the Radenza Group, which manages the Sicilian Coop stores, described the 4 a.m. attack on its frozen-food remote-control system to Italy's ANSA, and Portugal's Mosqueteiros group confirmed its seven Intermarché incidents to AFP directly. The claim was edited in place under replace-don't-stack; the earlier seven-country stage is in the update history.
On the ladder: a claim earns Verified from primary evidence, or from two independent sources that do not copy each other.
Why this label: Each element is the named company's or executive's own statement as carried by the Guardian (read in full in this pass) and Reuters: Ahold Delhaize's 'dozens', the per-chain store counts from Belgian reporting, and Moelans' defrost-mode account to Belga and Le Soir. One Belgian report of units reaching 70°C was NOT confirmed by any other source read and is not carried on this page.
On the ladder: a claim earns Verified from primary evidence, or from two independent sources that do not copy each other.
Why this label: Verified as each chain's or agency's own reported position, country by country, in the Guardian's full report (read in full in this pass), with the BBC's country-by-country reporting in agreement on the Swedish, Irish and Dutch counts. These are the affected companies' own incident reports — the underlying cause is carried at its own label in the next claim.
On the ladder: a claim earns Verified from primary evidence, or from two independent sources that do not copy each other.
Show all claims (4 more)
Why this label: The distinction is the story: the temperature rises and the food losses are multiply reported, but attribution and coordination are not established by any authority in the material read. Security experts quoted by Reuters (SentinelOne's Tom Hegel; Tributech's Patrick Lamplmair) assess the pattern — no financial demands — as pointing to sabotage rather than extortion, and note thousands of refrigeration controllers remained reachable from the internet after the French attack; those are expert assessments, carried as such, not findings.
On the ladder: the evidence so far sits low — early, single or social sources. We publish the claim as a claim, never as fact.
Why this label: The French precedent is multiply reported history: French police and the Paris prosecutor's figures (about 700 stores), the ANSSI investigation and the temperature range are carried by the Guardian (read in full in this pass) and by the BBC's and Reuters' reporting of the October attack. The link between the two waves is explicitly unestablished in every source read — it stays in this page's don't-know list.
On the ladder: a claim earns Verified from primary evidence, or from two independent sources that do not copy each other.
Why this label: Verified as the stated positions of the commissioner and the authorities named: Hansen's words and the Belgian, Italian and Finnish positions are all in AFP's full report (read in full in this pass); Hansen's quote is carried identically by the National Daily's account. A commissioner's characterisation of intent is his stated position, carried as such — investigators have not established who carried out the attacks.
On the ladder: a claim earns Verified from primary evidence, or from two independent sources that do not copy each other.
Why this label: The Danfoss connection rests on the retailers' and installers' own statements in AFP's report (ICA's spokesperson Helena Johansson; Kitman Coldtech's director Jann Mutso) — plausible and specific, but no authority has confirmed a single common system or perpetrator across the nine countries, and Danfoss itself had not commented. Labelled Not yet verified.
On the ladder: the evidence so far sits low — early, single or social sources. We publish the claim as a claim, never as fact.
What we know / what we don't know yet
What we know
- That fridges and freezers overheated overnight in nine countries, with named chains reporting incidents in each and temperatures up to 50°C — the first seven countries verified at publish by the Guardian, the BBC and Reuters in agreement; Italy and Portugal added by AFP's full account, with the affected retailers' own confirmations for both.
- The mechanism described in Belgium: evaporators switched into defrost mode, per the refrigeration operator Sabcobel; and the French October precedent in its established outline (up to 700 stores, prosecutor and ANSSI investigations).
- That nobody has claimed responsibility for either wave in the reports read.
Show more (1)
- The EU food commissioner's stated position — a deliberate attempt to disrupt the food supply chain — and that Belgian federal prosecutors have opened an investigation (AFP).
What we don't know yet
- Whether the nine countries' incidents are one coordinated operation — no authority has established that, and Belgium's cybersecurity centre says investigators have not established who was responsible.
- Who did it, and whether one actor links all seven countries — or links Monday's wave to France's October attack.
- How the controllers were reached in each country, and which equipment models were involved beyond the French attack's reporting.
Show more (2)
- The total loss figure — store-level estimates exist (one Belgian branch at about €100,000), but no official joint total has been published.
- Whether the Belgian report of units reaching 70°C is accurate — it appears in one report only and is not carried as fact on this page.
Why it matters
This is the second time in three weeks that Europe's food shops have woken to warm freezers and ruined stock — and this time it happened in nine countries in one night. Whoever is doing it needs no warehouse, no weapon and no ransom note: a reachable refrigeration controller and a few commands are enough to destroy a store's chilled stock overnight, which is why the EU's food commissioner is calling it a deliberate attempt to disrupt the supply chain while investigators still cannot say who it is.
Background
Show the background timeline (4)
Hackers seize cooling units in as many as 700 French supermarkets, pushing temperatures from −27°C to over 50°C; fires and food losses in the tens of millions of euros follow (French police; Paris prosecutor).
The Paris prosecutor opens a formal investigation; Prime Minister Sébastien Lecornu instructs ANSSI to investigate; ANSSI reports controllers from more than one supplier were targeted; Ahold Delhaize separately reports a cybersecurity incident to Dutch police (no link confirmed).
Temperatures rise overnight in stores across seven countries; Sabcobel mobilises technicians from 1 a.m. in Belgium to disconnect affected installations.
Chains in Belgium, Luxembourg, Sweden, Ireland, Estonia, the Netherlands and Finland report their incidents through the day; national cybersecurity agencies in Belgium and Sweden say they are monitoring/working on the incidents; no claim of responsibility.
Update history
No silent edits. Every change is written here, with its time.
- Latest
Checking in progress — the wave's scope is now nine countries, not seven (queue Q-2026-11-03-0845): AFP's full account, read in full in this pass, adds Italy and Portugal to the seven countries verified at publish, each new country confirmed by the retailers affected; the scope claim was edited in place, not stacked, and this page's web address was corrected to nine-countries to match. Added: the EU food commissioner's 'deliberate attempt to disrupt our food supply chain' position and the Belgian prosecutors' investigation (Verified as stated positions), and the Danfoss equipment connection (Not yet verified). No official video verified.
Story published in Checking state (queue #989). Basis: the Guardian's report read in full and Reuters, with the BBC in agreement on scope and counts. The overheating and food losses are verified; who did it, and whether the seven countries and the French October wave share a perpetrator, are labelled Not yet verified.