Colruyt Group

Summary

Colruyt Group reported that refrigeration systems in around five Spar stores operating under its franchise model in Belgium were disrupted by a cyberattack that caused temperatures in fridges and freezers to spike, forcing the disposal of spoiled food. The incident was part of a broader wave of attacks targeting supermarket cooling equipment across several European countries, with attackers switching units into defrost mode and remaining unidentified.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On November 2, 2026, a new wave of cyberattacks targeting refrigeration systems struck supermarkets across Europe, including Belgium and Luxembourg. The incidents followed a similar attack in mid-October that had affected hundreds of French supermarkets, in which attackers targeted refrigerators manufactured by Danfoss and caused cooling units to overheat. Colruyt Group, which operates Spar stores in Belgium under a franchise model, reported that fridges in around five of its Spar stores were affected by the incident. A company spokesperson stated that no Colruyt-branded stores had been affected, only the Spar franchise locations. The spokesperson said the company was doing everything it could to resolve the issue. Earlier reporting indicated that an IT incident overnight had sent temperatures inside fridges and freezers in stores in Belgium and Luxembourg soaring. The attacks occurred against a backdrop of prior activity, as Ahold Delhaize had reported a cybersecurity incident to police in the Netherlands in October after detecting suspicious activity in its infrastructure. In the affected Colruyt-operated Spar stores, the range of fresh and frozen products was temporarily somewhat limited. Despite the refrigeration failures, distribution centers continued to operate normally and there was no disruption to deliveries to stores. All affected stores remained open during the incident.

Refrigeration units in the affected locations experienced temperature spikes, with some systems shutting down entirely and others partially impaired. In at least one case reported elsewhere in the wave, a refrigeration system began to generate heat, though specific Colruyt locations were not described as reaching that state. Spoiled food had to be discarded at affected grocery outlets across the region. Belgian broadcaster RTBF cited a store manager describing the problems as a cyberattack similar to those in France. The Centre for Cybersecurity Belgium said it was closely following the incident and noted that the attackers were unknown and might never be identified. No group claimed responsibility for the attacks targeting grocery retailers in Europe. Colruyt's response focused on resolving the refrigeration issue at the five Spar stores while maintaining normal operations elsewhere in its network. The company did not report any impact to its central systems or distribution logistics. Investigators and cybersecurity researchers examined whether the incidents were connected to the earlier French attacks or represented a separate campaign, but no attribution had been established by the time of reporting.

Sources

Sources available to members: 4 sources.