Ahold Delhaize

Summary

Ahold Delhaize reported that a cyberattack caused temperatures in refrigerators and freezers at dozens of its stores in Belgium and Luxembourg to spike, spoiling food and forcing shelves to be cleared. The company’s refrigeration operator said attackers switched evaporators into defrost mode and technicians worked through the night to disconnect affected units from the network. The disruption echoed earlier attacks on supermarket cooling systems across Europe, with no group claiming responsibility.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In October, Ahold Delhaize reported a cybersecurity incident to police in the Netherlands after detecting suspicious activity in its infrastructure. On Monday, November 2, 2026, the company realized there were temperature increases in the cooling systems of its supermarkets. An IT incident overnight had sent temperatures inside refrigerators and freezers in dozens of Ahold Delhaize stores in Belgium and Luxembourg soaring. The chain later confirmed that the incident was a cyberattack. Sarah De Meester, a company spokesperson, told Reuters that the range of fresh and frozen products was temporarily somewhat limited in affected shops, while distribution centres continued to operate normally and there was no disruption to deliveries.

The refrigeration systems used by Delhaize and other chains are operated by Sabcobel, a Belgian refrigeration company. Stephan Moelans, the chief executive of Sabcobel, told Belgium's national Belga news agency that a cyberattack was to blame after the units' evaporators were switched into defrost mode. Sabcobel began mobilizing technicians at 1 a.m. to get the situation under control. Technicians worked through the night and morning to disconnect the affected installations from the network. Reporters visiting a shop north-east of Brussels observed refrigerators and freezers that were empty, with a sign stating that due to cyberattacks there would be no products on the refrigerated or freezer shelves. Moelans noted that over the past few weeks his company had been working hard to protect customers' fridges against this vulnerability, but many units would require physical modifications, and that requires investment. The temperature spikes forced stores to discard spoiled food and contributed to empty refrigerated and freezer shelves across the affected locations.

The Ahold Delhaize disruption was part of a wider wave of similar incidents across Europe on the same day. Supermarket chains in at least seven European countries reported that cooling unit temperatures rose overnight to as high as 50 degrees Celsius. Swedish chains ICA and Coop reported sharp temperature increases in freezers at several stores, with one ICA location in Sjobo posting that its fridges and freezers had been hacked and set to 50 degrees Celsius. The incidents echoed an earlier cyberattack in France on the night of October 11 to 12, when hackers gained remote access to software controlling temperatures in refrigerators, freezers, and cold-storage rooms used by major French supermarket chains. In that French attack, attackers changed settings remotely, causing temperatures to rise in many cases to 50 degrees Celsius, with the heating timed to occur between 11 p.m. and 4 a.m. when stores were closed. French authorities reported that more than 400 supermarket locations had been affected, including chains such as Intermarché, Netto, Coopérative U, Carrefour, Monoprix, and E.Leclerc. The Paris prosecutor's office opened an investigation into the French attack, and France's national cybersecurity agency, Ansii, was instructed to investigate. The French attack targeted refrigeration control systems supplied by the Danish company Danfoss, which had previously disclosed critical security vulnerabilities affecting software packages used in its refrigeration systems. There had been no claim of responsibility for any hack targeting grocery retailers in Europe to date.

Sources

Sources available to members: 3 sources.