Ikea

Summary

A suspected cyber-attack compromised refrigeration controllers across several European supermarket chains, driving freezer temperatures up to 50C and forcing stores to pull chilled and frozen goods while expecting food waste. Ikea said its Mons shop in Belgium was hit when freezer temperatures rose suddenly, leading to the precautionary removal of some food products. The incidents affected retailers in at least seven countries and are being investigated as sabotage with no financial demands made.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Supermarket chains across at least seven European countries reported problems with refrigeration systems on Monday, November 2, 2026, in a fresh suspected cyber-attack following a similar incident in France the previous month. Retailers in Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands, and Sweden said temperatures in refrigerators and freezers in some shops rose overnight to as high as 50 degrees Celsius. An Ikea Belgium spokesperson told Agence France-Presse that a cyber-attack had caused the temperature of freezers in its Mons shop to rise suddenly. Ikea stated that it had to remove some food products from refrigeration units as a precaution and expected some food waste as a result. The broader wave of disruptions followed an attack in France in which hackers seized control of cooling units in as many as 700 supermarkets, raising temperatures as high as 50 degrees Celsius and causing fires and food losses estimated in the tens of millions of euros. EU food and agriculture commissioner Christophe Hansen described the repeated cyber-attacks as deeply concerning, calling them a deliberate attempt to disrupt the food supply chain and undermine consumer confidence.

The incidents involved the remote compromise of operational technology devices, including refrigeration controllers, building management systems, and related equipment. In the French attack, hackers pirated controllers mostly supplied by the Danish company Danfoss and remotely overrode settings on thousands of freezers, fridges, and chiller cabinets, pushing temperatures from as low as minus 27 degrees Celsius to well over 50 degrees Celsius. Shops in that earlier incident had to discard vast quantities of fresh meat, dairy, and frozen products, with individual supermarket losses ranging from tens of thousands of euros to more than 130,000 euros. The Paris prosecutor's office opened a formal investigation into the French attack, and France's national cybersecurity agency, ANSSI, was instructed to investigate. Authorities reported that supermarkets using controllers from two other companies had also been targeted in the French attack, though no claims of responsibility had been made and no perpetrator had been identified.

Ikea Belgium confirmed that freezer temperatures rose suddenly at its Mons shop due to the cyber-attack. The company removed affected food products from refrigeration units as a precautionary measure and anticipated some food waste. Across the affected region, other retailers reported similar disruptions, with Sweden's Coop chain saying six shops were hit and ICA acknowledging a limited number of stores affected overnight. In Belgium, Ahold Delhaize reported that fridges and freezers in dozens of supermarkets in Belgium and Luxembourg had been hit, while Carrefour Belgium reported disruption in about 15 of its 700 shops. Technicians were mobilized in the early hours to disconnect affected installations, with Sabcobel, which operates Delhaize's refrigeration systems, stating that units' evaporators were switched to defrost mode. The Selver supermarket chain in Estonia said one outlet had been affected after attackers accessed a computer controlling the refrigeration system and turned the temperature to 50 degrees Celsius, though the attack was responded to within minutes and there had been no significant damage. Ireland's SuperValu chain said refrigeration systems limited to a specific model in 13 of its 223 shops had been affected, with chilled and frozen products removed from sale.

Sweden's national cybersecurity centre said it was working on incidents around the country and had established that the country had quite a lot of exposed operational technology devices needing updating or patching. The Dutch retailer Ahold Delhaize said distribution centres were operating normally and there was no disruption to deliveries, though the range of fresh and frozen products was temporarily somewhat limited in affected shops. No financial demands were reported in connection with the supermarket attacks, and cybersecurity researchers described the activity as sabotage rather than extortion. Authorities have not indicated who could have been behind the incidents, and the attacks occurred amid broader concerns about government-sponsored hybrid attacks following Russia's 2022 invasion of Ukraine. Thousands of these controllers were still reachable from the internet after the French attack, and many refrigeration systems had known and as yet unfixed flaws.

Sources

Sources available to members: 2 sources.