Supermarket freezers failed across nine European countries and no government has named a culprit

Temperature controls at grocery refrigerators across Europe were manipulated in the early hours of Monday 2 November, the second such wave in weeks. Recorded Future News reported more than 50 affected stores identified in Belgium and over a dozen more in Ireland, Estonia, the Netherlands and Luxembourg, with retailers describing a “limited number” of smaller stores hit in Sweden. A spokesperson for the privately held Swedish chain ICA told Reuters by email: “We are aware that a limited number of stores were affected by an incident overnight, which impacted their refrigeration and freezer systems.” The Belga news agency reported overnight temperature increases at dozens of Ahold Delhaize stores in Belgium and Luxembourg, blamed on a cyberattack by the chief executive of the refrigeration company Sabcobel. Katrien Eggers, spokesperson for the Centre for Cybersecurity Belgium, told Recorded Future News her agency was aware of the incident but could not provide further information.

Two attribution tracks are circulating, and neither rests on a named official. United24 Media, a Ukrainian state-founded outlet, relayed POLITICO reporting of 3 November that the attacks spanned at least nine EU countries — Belgium, Luxembourg, Sweden, Germany, Ireland, the Netherlands, Estonia, Finland and Romania — and that cybersecurity experts, unnamed, suggested a link to Russian hybrid operations. Separately, Nextgov/FCW’s David DiMolfetta reported on 29 October that officials, also unnamed, suspect Iran in a series of cyberattacks on freezers at US military bases; the conditional framing that this would demonstrate Tehran’s ability to disrupt military-related equipment is the publication’s own. Those are two different incidents in two theatres, and no published technical evidence links them. Al Jazeera managed to invoke both hypotheses in a single sentence, citing concern over hybrid warfare stemming from Russia’s invasion of Ukraine and the Iran–United States war.

The one on-the-record official response came from Jerusalem. The Israel National Cyber Directorate issued a warning on Monday to retail chains, food companies and logistics centres, urging them to inspect refrigeration and control systems with particular attention to those permitting remote access by technicians and service providers, and to report back with inspection results and the protective measures taken. INCD said, via Israel National News, that attackers exploited vulnerabilities in internet-connected control systems, remotely changing temperature settings and activating defrosting mechanisms. Its mitigations, reported by i24NEWS, were conventional and specific: keep control systems off the open internet, replace default passwords, update outdated systems. The advisory describes a vector without naming an actor — which is more than any European agency has published four days into the second wave.

Assessment: The useful question is not which state did it but whether these were nine national incidents or one supplier. French retailers in the October wave outsourced refrigeration management to third parties and could not set their own security; if the Belgian, Swedish and Irish victims share an equipment vendor or a remote-access platform, this is a supply-chain compromise and the country count is noise. Sabcobel’s chief executive has already spoken; the suppliers are the reportable party. Treat the Russia and Iran theories as equally unevidenced, and note that both are convenient to someone. Watch for an ANSSI, CCB, ENISA or Europol statement naming a controller vendor or CVE. CISA’s April advisory on Iranian-affiliated actors and exposed programmable logic controllers is resurfacing alongside this story; nothing published connects them.