November 2 Fridge Attacks: 11 Countries, Blood Banks, No Attribution

WarBrief Live | November 12, 2026 | Cyber Warfare

On November 2, 2026, suspected cyberattacks overheated supermarket refrigeration across at least nine European countries, three weeks after a similar attack hit about 700 stores in France. No one has been blamed for the second wave.

What happened on November 2, 2026?

Overnight on November 2, refrigeration systems in supermarkets and food businesses across Europe began warming up on their own. Freezers and chilled cabinets that should have held food at a few degrees above or below zero were remotely switched into defrost mode, and in some stores the temperature climbed to 50°C (122°F). Staff arrived in the morning to spoiled stock, alarms, and in some cases stores that had to close while food was thrown away. Al Jazeera reported that supermarkets and food businesses in at least nine European countries were affected: Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden. The Associated Press, reporting on November 3, put the cost in the millions of euros, with tonnes of spoiled food.

Belgium was hit hardest. About 40 Delhaize stores, 15 Carrefour stores and 5 Spar stores were affected, along with an IKEA store in Mons, and a Belgian media tally counted at least 76 outlets with refrigeration problems. Belgium’s federal prosecutor opened a criminal investigation. One Delhaize store in Hoeilaart, near Brussels, lost at least €100,000 of frozen food and stayed closed until about noon, its manager told Belgian outlet HLN. Ahold Delhaize, Delhaize’s parent company, called the incident an “IT incident”.

Elsewhere, 13 SuperValu stores run by Ireland’s Musgrave group were hit; an ICA store in Sjöbo, Sweden, told customers its units had been hacked and set to 50°C, while Coop reported seven of its 800 stores affected, although the company said it had no information pointing to a cyberattack; at least 17 small businesses in the Netherlands, mostly butchers and small grocers, were affected; Finland’s Kesko chain and a Selver store in Estonia reported problems; and in Greece, a butcher in the Athens suburb of Kifisia told broadcaster Skai TV that a refrigeration unit had been raised to 150°C and took a technician two hours to regain control. Further reports followed in the days after from Germany, Romania and the United Kingdom, bringing the reported total past eleven countries.

Background and timeline: two waves in three weeks

The November 2 wave was the second in less than a month, and it followed almost the same script as the first. On the night of October 11 and 12, attackers took control of refrigeration systems in about 700 stores in France, heating units to as high as 50°C. French authorities said the attack caused fires and food losses worth tens of millions of euros, and France later called it the first large-scale sabotage cyberattack on French soil.

• October 11–12: About 700 French stores hit; units heated to 50°C. CERT-FR issues alert CERTFR-2026-ALE-012 on October 12.
• October 13: Danfoss, the Danish maker of the affected controllers, advises operators to take exposed systems offline.
• October 21: Vincent Strubel, head of France’s National Cybersecurity Agency (ANSSI), tells the French Senate that the healthcare sector uses the same type of equipment to store vaccines and hazardous materials.
• November 1–2: The second wave hits supermarkets in at least nine countries, and three sites of France’s national blood service are targeted the same night.
• November 3: Two pro-Russian hacktivist groups claim responsibility on Telegram. Le Canard enchaîné reports the blood-bank attacks.
• November 3–4: The French Blood Establishment confirms three of its sites were affected; the UK’s National Cyber Security Centre works through the night contacting organisations with vulnerable technology exposed.
• November 5: Five US agencies issue a joint advisory on the refrigeration attacks.
• November 9: France formally attributes the October wave to Shahid Kaveh, a cyber unit affiliated with Iran’s Islamic Revolutionary Guard Corps, and announces sanctions on Iran in retaliation.
• November 11: Al Jazeera publishes a detailed explainer on the two waves and the wider risk to connected devices.

How can a fridge be hacked?

A supermarket’s fridges and freezers are run from one control panel, connected to the internet so contractors can monitor temperatures and fix faults remotely across hundreds of stores. That connection is the vulnerability. According to Vincent Strubel, the attackers found the supermarket systems using Shodan, a search engine for internet-connected devices, and got in through basic security failures: equipment directly connected to the open internet with no extra protection, weak or default logins, and old models that no longer receive security updates.

Once inside, the attackers did not need to break anything. They used the controllers’ own defrost function, which briefly warms a unit to melt ice off its coils, and left it running. In Belgium, refrigeration contractor Sabcobel said attackers switched cooling units into defrost mode so the machines kept heating instead of cooling. France’s ANSSI said it knew of compromised controllers in Danfoss’s AK-SM and AK-SC ranges, as well as Copeland and Dixell XWEB systems, and has been investigating refrigeration-system breaches since mid-October.

Danfoss said most affected systems were older products that no longer received software or security updates, while Copeland identified a vulnerability in discontinued controllers. Security researchers at Claroty’s Team82 reported three flaws in Danfoss AK-SM 800A controllers, including CVE-2025-41450, a high-severity authentication bypass. The lesson, experts told the Associated Press, is that this was not a sophisticated break-in. “Nobody broke into these refrigeration systems with a zero-day,” said Nicole Carignan of cybersecurity company Darktrace. “They got in through internet-facing controllers, end-of-life firmware, and default passwords. That is technical debt coming due.” As Katerina Mitrokotsa, a cybersecurity professor at the University of St. Gallen, put it: “A fridge doesn’t look like a security risk, and that’s exactly why attackers like it.”

The same class of weakness — internet-exposed hardware left unpatched — recurs in WarBrief’s cyber coverage, from the Zyxel switch flaws that left nearly a thousand devices exposed despite a patch, to the Vanderbilt ransomware incident, where everyday devices became the way in.

By the numbers: the November 2 wave

Figures marked CONFIRMED are supported by two or more sources or by an official statement. Figures marked REPORTED rest on a single or secondary source and should be treated with caution.

Who is behind the November 2 attacks?

As of November 12, no government has attributed the November 2 wave to anyone, and no group has credibly claimed it. That is the most important fact about the second wave, and the one most often blurred in coverage.

France’s attribution covers the October wave only. On November 9, French Foreign Minister Jean-Noël Barrot told a G7 ministerial meeting in Paris that the October attack “was carried out by the Islamic Revolutionary Guard Corps”, and Paris prosecutor Laure Beccuau opened a judicial investigation into the head of Shahid Kaveh and two deputies, seeking international arrest warrants on charges of organised cybercrime committed to serve the interests of a foreign power, in this case Iran. WarBrief covered that attribution in its CyberAv3ngers explainer. But the French case does not cover November, and investigators have not confirmed whether the two waves are connected.

Two pro-Russian hacktivist groups, NoName057(16) and Z-Pentest, claimed responsibility for the November wave on Telegram on November 3, blaming operators for “systemic negligence”. French security firm Sekoia assessed the claim as unsubstantiated, noting the group’s history of misleading claims. Belgium’s Centre for Cybersecurity has said the perpetrators may never be identified. Shared methods do not prove shared attackers: the same exposed controllers and the same defrost trick are available to anyone who finds them.

A third, older thread should not be folded into the November wave without evidence. Suspected attacks on freezer systems at six US military commissaries in August are unconfirmed, and the Pentagon is reported to be investigating. Five US agencies issued a joint advisory on the refrigeration attacks on November 5, but that advisory does not attribute the incidents to anyone.

Why the blood banks changed the story

The most alarming part of the November 2 wave did not involve a supermarket at all. Overnight between November 1 and 2, attackers took control of refrigeration controllers at three cold-storage sites run by France’s national blood service, the Établissement français du sang (EFS), notably in the Bourgogne-Franche-Comté region. The EFS confirmed the incident on November 3, saying it affected three of its sites and that the intrusion pushed temperature and defrosting thresholds “to extremely high levels” on the targeted units.

Secondary reports, citing Le Canard enchaîné, put the programmed setpoint as high as 110°C, up from a normal operating temperature of −30°C. That figure is reported, not confirmed: it does not appear in the EFS statement itself, and it is not known whether the units actually reached that temperature. What is confirmed is that alarms caught the change in time, staff moved the plasma to unaffected storage, and the EFS said no blood products were lost and no health consequences were identified. Infosecurity Magazine reported that the EFS notified ANSSI and that the Health Ministry is investigating.

The attackers reached the blood-bank equipment through a third-party refrigeration provider, not through the EFS’s own network; reporting identified the provider as Coolworld Rentals, a Dutch temperature-control company. The incident matters because it shows the same weakness sitting upstream of a life-critical supply. As ANSSI’s Vincent Strubel warned the French Senate on October 21, the healthcare sector uses the same type of equipment to store vaccines and hazardous materials, from research laboratories to pharmacies. An attack on those systems could have far more serious consequences than spoiled food.

What the November 2 fridge attacks mean for US, UK and EU readers

For readers in the United States, the United Kingdom and the European Union, the attacks matter in three concrete ways: food, homes and hospitals. On food, the November wave caused localised disruption rather than widespread shortages, but it still destroyed tonnes of food and cost millions of euros, and the European Commission described it as an attempt to deliberately sabotage the food supply chain. Shoppers in affected areas found empty chilled and frozen shelves for a morning, and retailers had to discard stock. The Commission’s spokesperson, Thomas Regnier, said the incidents “are not isolated” and that Europeans “have to be collectively resilient and prepared for such cyber incidents”. The Commission held a crisis meeting with the EU cybersecurity agency ENISA and Europol, and France has said it will press EU partners for bloc-wide measures at the Foreign Affairs Council on November 16.

On homes, the same weaknesses exist in household devices: smart fridges, routers, smart TVs and robot vacuums all connect to the internet in the same way. The UK’s National Cyber Security Centre warned in April that hackers linked to Russia’s GRU military intelligence were hijacking home and small-business routers, and after the November wave its director, Richard Horne, said the French fridges had been “connected directly to the internet with default passwords”. The advice from the UK’s centre, from France’s ANSSI and from independent experts is practical rather than dramatic: change default passwords, keep software updated, switch off remote access you do not use, and do not leave old devices that no longer receive security updates connected to the network.

On hospitals, the blood-bank incident is the warning. The United States is not a bystander either: five US agencies issued a joint advisory on November 5, and suspected freezer failures at US military commissaries in August remain under investigation. A fridge is the least dramatic target on any critical-infrastructure list, and that is precisely why it worked.

What to watch next in the European cold-chain investigation

Four things will decide how this story develops. First, the Belgian federal prosecutor’s investigation, which may establish whether the November wave was a coordinated campaign or a set of copycat intrusions using the same public techniques. Second, the European Union’s response: France will seek EU sanctions against the IRGC unit it blames for the October wave at the Foreign Affairs Council on November 16, and the Commission has promised a collective response to the November wave. Third, the technical clean-up: ANSSI’s alert on the affected controller families is updated regularly, and operators across Europe are being told to take exposed systems offline, change default credentials and patch where patches exist. And fourth, the US advisory process, which may clarify whether the suspected August commissary incidents are connected to the European waves at all.

The deeper question is whether anything changes. The controllers were known to be exposed, and Danfoss had warned about the same controller family in 2022. The November wave happened three weeks after the October wave, using the same method, against the same kind of equipment. Until exposed controllers are taken offline or secured, the next wave needs no new vulnerability — only a new target list. For the background on the October attribution, see WarBrief’s CyberAv3ngers explainer; for the wider picture of pressure on Europe, see the conflict-zones hub and the sanctions hub, which tracks the measures being prepared in response.

Frequently asked questions

What happened in the November 2 fridge cyberattacks?
Suspected cyberattacks remotely switched supermarket and food-business refrigeration into defrost mode overnight on November 2, 2026, overheating units in at least nine European countries. More than 100 stores and food businesses were reported disrupted, with Belgium hit hardest. Three French blood-bank sites were targeted the same night.

How can a fridge be hacked?
Supermarket fridges are run from a central control panel connected to the internet so contractors can manage them remotely. Attackers found the panels with the Shodan search engine and got in through exposed connections, weak or default passwords, and old models that no longer receive security updates, then used the controllers’ own defrost function to heat the units.

Who is behind the November 2 fridge attacks?
No one has been blamed. France attributed the earlier October wave to Shahid Kaveh, an IRGC-affiliated cyber unit, but that attribution does not cover November. Two hacktivist groups claimed the November wave on Telegram, but security firm Sekoia assessed the claim as unsubstantiated, and Belgium’s cybersecurity centre has said the perpetrators may never be identified.

Were blood supplies damaged in the attacks?
No. Three cold-storage sites of France’s national blood service were targeted overnight between November 1 and 2, and the temperature thresholds were raised to extremely high levels. Alarms caught the change, staff moved the plasma, and the service confirmed that no blood products were lost and no health consequences were identified.

Could my home fridge be hacked?
Household smart fridges connect to the internet in the same way, through Wi-Fi, an app or a cloud service, so the same weaknesses can apply. Experts advise changing default passwords, keeping software updated, switching off remote access you do not use, and not leaving old devices that no longer receive updates connected to the network.

Sources

• Al Jazeera: If hackers can take over a supermarket fridge, what else is at risk?
• Associated Press via TechXplore: European supermarket fridges got hacked. Again. Here’s what to know
• Vietnam News Agency: France accuses Iran of being behind the unprecedented cyberattack on supermarket refrigerators
• Infosecurity Magazine: France Blood Service Hack Sends Blood Storage Temperatures to 110°C
• CPO Magazine: French Blood Banks Heated to Boiling Temperatures Following Cyber Attack on Cold Storage Facilities
• Secuna: Hackers Heated Supermarket Freezers Across Europe. What Happens When They Target Your Connected Infrastructure?