Cyber attacks disrupted the refrigeration facilities of European shops on 2 November 2026. Carrefour confirms fifteen affected stores in Belgium. Other brands have removed fresh and frozen products. Three weeks after the French incidents, the protection of remote-controlled equipment is at the forefront.
The new series of incidents is not just about online shopping sites. It reaches the devices that keep the goods. When their operation is diverted, the risk becomes material: rising temperatures, unusable products and restocking rays. The affected stores must then restore the cold and control their stocks.
Cyber attacks: different effects according to the signs
In Belgium, Carrefour describes the impact as very limited. In its press release of 2 November, the group states that fifteen of its approximately seven hundred stores are slightly affected. He states that all of his outlets remain open and that the products remain available. This assessment concerns its Belgian network, not all the country’s businesses.
Delhaize also reported a computer incident affecting the refrigeration of dozens of stores. The majority are in Belgium, with a few establishments in Luxembourg. In the statements relayed on 2 November, the brand distinguishes the in-store disturbances from the operation of its distribution centres. These remain operational.
In Ireland, Musgrave reported that thirteen SuperValu stores had experienced an incident on their refrigeration equipment. Fresh and frozen products have been removed as a precaution. The company then announced the resolution of the incident and the resupply of the spokes concerned. This local recovery is not a review of the entire European wave.
The first reports also concern Sweden and Estonia. The reported abnormal temperatures vary according to the facilities and testimonies. It would therefore be misleading to apply the same figure to all stores, or to convert the number of devices identified to the number of establishments affected.
Resemblances with October, without established common author
The events recall the attacks on French installations in October. The reconciliation covers equipment type and temperature changes. It is not enough alone to identify those responsible.
In his analysis on November 2, Censys’ research team noted this similarity. However, it states that no group claimed responsibility for the attacks it examines. Nor does it confirm the intervention of an identical actor in both sequences. The identity of the authors and their motivation remain open.
Technical monitoring provides another indicator. Censys observes a little over a thousand Danfoss StoreView interfaces exhibited on the Internet worldwide. In France, its survey increased from 1,825 interfaces before the attacks of October to 220 at the time of the analysis. This decrease measures visible exposure from the Internet. It does not prove that all systems have been corrected or that each of the remaining equipment has been attacked.
Remote piloting, a point of fragility
Refrigeration controllers centralize important business functions. They can monitor temperatures, view alarms and adjust certain parameters. Remote maintenance also avoids the systematic movement of technicians. But this convenience requires protecting access to the management console.
Research published in August by Team82 of Claroty identified several vulnerabilities on the Danfoss AK-SM 800A platform. The researchers had passed on their findings to the manufacturer, who had published patches. This work demonstrated the possible consequences of unauthorized access to administrative functions.
However, the existence of documented vulnerabilities makes it impossible to designate the one used in each trade on 2 November. A device visible on the Internet, an old version and a proven compromise correspond to three different findings. Investigations must determine what equipment has actually been reached and how.
A French alert always relevant to operators
CERT-FR issued an alert as early as 12 October, updated on 16. She reported compromises affecting several families of Danfoss, Copeland and Dixell controllers. The Authority recalled that a management interface should not remain directly accessible from the Internet.
Its recommendations combine access protection, configuration verification and manufacturer’s measurements. They distinguish between already compromised installations and still saved equipment. They also call for a review of contractual constraints before interrupting data returns to the fridge.
The bulletin highlights that a simple reset is not enough when a device remains vulnerable and exposed. The restoration of the service must therefore be accompanied by adequate security, carried out with the professionals responsible for the installations.
For the signs, two construction sites advance in parallel: find a normal offer in radius and determine the origin of the disturbances. The results available on the morning of 3 November remain specific to each network. No definitive European total of the losses or common allocation of the attacks has been publicly established.
Cover: Frozen radius photographed on January 21, 2016. Illustrative archive; the store is not presented as a victim of the attacks of November 2026. Photo:Raysonho @ Open Grid Scheduler / Grid Engine, Wikimedia Commons,CC0 1.0. Boxing and dressing Libnanews.
Comments