Short answer
In the night to 2 November 2026, refrigeration controls were tampered with at supermarkets in Belgium, Luxembourg and Sweden, and an Edeka store in Reisbach, Bavaria reported the same night. The pattern matches the French attacks of mid-October. Police in Germany have not confirmed the cause, and no data theft is reported.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Delhaize, Carrefour, Spar, ICA, Coop and an Edeka store (Reisbach) |
|---|---|
| Incident type | Supply-chain compromise |
| Status | Under investigation |
| Sector | Retail (supermarkets and refrigeration systems) |
| Country | Belgium, Sweden, Luxembourg and Germany |
| Detected | 2026-11-02 |
| Disclosed | 2026-11-02 |
| People or records affected | Roughly 40 Delhaize, 15 Carrefour and 5 Spar stores in Belgium and six Coop branches in Sweden (heise online); one Edeka store confirmed in Bavaria |
What data was exposed
- No customer or personal data has been reported as exposed. The attacks changed temperatures and defrost settings on store refrigeration units.
What happened
Attacks on internet-connected supermarket refrigeration spread beyond France in the night to Monday 2 November 2026. heise online reports incidents in Belgium, Luxembourg and Sweden: about 40 Delhaize, 15 Carrefour and five Spar stores plus the butcher chain De Laet en Van Haver in Belgium, Delhaize stores in Luxembourg, and several ICA and Coop branches in Sweden. Coop said six branches were hit.
Our earlier report covers the French supermarket refrigeration attacks from mid-October.
Belgium
Security.nl reported that several Belgian stores found their cooling systems tampered with and destroyed their stock. The installer Sabcobel said its staff began mobilizing at 1 a.m. to regain control. One butcher said the evaporators were set to defrost so that the heating elements warmed the fridges. Reports put the temperatures at up to 70 degrees, which Delhaize has not confirmed. The entry point in Belgium has not been identified.
Germany
heise online describes the first German case at an Edeka store in Reisbach, Lower Bavaria. The operator said on Facebook that the cooling was heated to 50 degrees overnight and much food was thrown away. Police have not confirmed a cyberattack as the cause, and the operator has taken the systems off the internet. Reports from North Rhine-Westphalia, citing WDR, give no details. The Federal Office for Information Security (BSI) has issued a warning.
Likely cause, and what is not known
For France, heise reports attackers used security gaps in older Danfoss controllers that no longer get updates. Danfoss advises firmware updates or replacing old systems. It is not confirmed that the new cases used the same method, and nobody has been named as responsible. The BSI president said the attack could have hit any country.
Why this matters to shoppers
No personal data is reported lost, so there is no breach for shoppers to act on. The risk is opportunistic scams. After a widely reported incident, scammers send fake refund or recall notices using a retailer’s name. Our guide to phishing messages explains how to check them, and what to do after a data breach is a useful checklist if a message asks for details.
What shop operators can do
Check whether cooling controllers are reachable from the internet, restrict access, change default passwords and apply updates. Our breach tracker lists related incidents.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake 'food recall' or 'spoiled goods compensation' messages that use a supermarket's name to collect card details.
- Lookalike loyalty-card or refund pages claiming to repay customers.
- Phishing aimed at store and supplier staff, posing as the refrigeration maker or an IT helpdesk and asking for logins or firmware 'updates'.
- Cold calls to shop owners from people posing as security agencies who ask for remote access to cooling equipment.
What to do if you are affected
- 01Treat unexpected refund, recall or compensation messages from a supermarket as suspect and go to the retailer's official site or app yourself.
- 02Never enter card or loyalty-account details through a link in a message about this incident.
- 03Operators should take internet-facing refrigeration controllers off the open internet or restrict access, as the BSI and the maker advise.
- 04Install current firmware, replace controllers that no longer get updates, and change default passwords.
- 05Verify any IT or vendor request through a phone number you already know before sharing credentials.
Frequently asked questions
Which supermarkets were hit in the November attacks?
Reports name Delhaize, Carrefour, Spar and the butcher chain De Laet en Van Haver in Belgium, Delhaize in Luxembourg, ICA and Coop branches in Sweden, and an Edeka store in Reisbach, Bavaria.
Was customer data stolen?
None of the sources we read reports data theft. The documented harm is spoiled food, temporary closures and clean-up costs.
Is it the same attack as in France?
heise online says the Swedish temperature settings match those used in France, but it is not confirmed that the same method was used. German police have not confirmed that a cyberattack caused the Bavarian case.
What device is involved?
For the French attacks, heise reports Danfoss AK-SM 800 and AK-SC 355 controllers that no longer receive security updates. Whether the same devices were hit in the new cases is not confirmed.
Is food in the shops still safe?
Affected stock was thrown away for hygiene reasons, according to the reports, and some shops closed. If a store was affected, it removed the stock before reopening.
Sources
- Kühlschränke in Lebensmittelläden weiterer Länder geknackt, heise online, 2026-11-02
- Erste deutsche Fälle: Cyberangriffe auf Kühlschränke in Bayern und NRW, heise online, 2026-11-03
- Koelsystemen Belgische supermarkten Carrefour en Delhaize gehackt, Security.nl, 2026-11-02
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.