The Delhaize refrigeration incident disrupted refrigerators and freezers at more than 40 Belgian supermarkets on 2 November 2026. Chilled and frozen aisles were closed or emptied at some locations after rising temperatures broke the cold chain.
Media reports have described the disruption as a hack, but Delhaize has so far confirmed only that an IT incident affected its refrigeration systems. The company has not confirmed a cyberattack, and the cause remains under investigation.
What happened during the Delhaize refrigeration incident
The disruption occurred during the night of 1 to 2 November and affected stores across Flanders and Wallonia. Delhaize reportedly warned store managers about sudden temperature increases, with one report stating that stores were notified at around 04:00.
Refrigerators and freezers stopped maintaining their required temperatures. VRT reported that temperatures rose to approximately 15 degrees Celsius, creating an immediate food safety and stock management problem for affected supermarkets.
Some stores sealed off chilled and frozen sections, removed products from display cases and destroyed stock that could no longer be sold safely. A photograph from Proxy Delhaize Hoepertingen showed a notice telling customers that its fridges and freezers had been hacked and that products had been removed and destroyed.
Reports that temperatures were changed to as much as 70 degrees Celsius have not been confirmed by Delhaize. These higher figures should therefore be treated as unverified, rather than as an established detail of the Delhaize refrigeration incident.
Carrefour stores also reported cooling problems
Several reports said at least 15 Carrefour Belgium stores experienced cooling problems during the same night. No technical or operational link between the Carrefour disruption and the Delhaize refrigeration incident has been established publicly.
The similar timing is notable, but it does not prove that the same system, vulnerability or threat actor was involved. Carrefour has not been identified as part of a confirmed coordinated campaign in the available reporting.
How the refrigeration systems were reportedly manipulated
Belgian media and retail publications reported that refrigeration control parameters had been changed, causing equipment to warm instead of cool. An operations lead at Belgian butcher group De Laet & Van Haver said evaporators had been placed into defrost mode, which caused components to heat up.
Commercial refrigeration systems periodically use defrost cycles to remove ice from evaporator coils. If a remote operator activates defrost at the wrong time, extends the cycle or alters temperature setpoints, display cases can quickly move outside safe limits.
This behaviour could be produced through a compromised remote management interface, stolen maintenance credentials or unauthorised access to a connected controller. However, none of those possible entry routes has been confirmed in the Delhaize refrigeration incident.
Delhaize has not published a technical root cause. It has also not released network logs, malicious domains, IP addresses, file hashes or other indicators that organisations could use to check for the same activity.
Timeline of the Delhaize refrigeration incident
-
12 October 2026: Large French supermarket chains experienced a cyberattack in which refrigeration equipment reportedly heated to around 50 degrees Celsius.
-
12 to 19 October 2026: Ahold Delhaize disclosed and updated information about a separate company cybersecurity incident. Systems were taken offline as a precaution, but that event has not been connected to the Belgian refrigeration disruption.
-
Night of 1 to 2 November 2026: Refrigeration and freezer systems at Delhaize stores experienced sudden temperature increases. Some stores removed or destroyed affected products.
-
2 November 2026: Public reports described the event as a hack. Delhaize confirmed an IT incident affecting more than 40 stores across Flanders and Wallonia but did not confirm a cyberattack.
-
Morning of 2 November 2026: VRT reported that remediation was under way and that the cause of the Delhaize refrigeration incident remained under investigation.
Affected refrigeration products and current status
No refrigeration vendor, controller model, firmware release or software version has been named by Delhaize. Public information identifies only the affected store refrigeration and freezer control systems.
Reports about the French incidents in October referred to vulnerabilities affecting Danfoss refrigeration system managers, particularly the AK-SM 800A family. There is no confirmation that Delhaize uses these controllers or that a Danfoss vulnerability played any role in Belgium.
No threat actor has claimed responsibility credibly, and no proof of concept or attack tool has been connected to the Belgian event. It is therefore not possible to determine whether the Delhaize refrigeration incident involved exploitation of a software flaw, compromised credentials, exposed management services or another failure.
The physical and operational effects are confirmed, meaning that the incident caused real disruption rather than representing a theoretical weakness. What remains unconfirmed is whether malicious access caused those effects and, if so, how access was obtained.
Similar incidents reported elsewhere
Swedish media reported similar manipulation of fridges and freezers at several ICA supermarkets during the same night. Some Swedish stores reportedly recorded temperatures of 50 degrees Celsius, but no link to Belgium has been demonstrated.
Together with the French events from October, these reports indicate active interest in internet-connected retail refrigeration. They do not establish that every incident used the same technology or method.
Why this incident matters to UK organisations
The Delhaize refrigeration incident shows how disruption to operational technology can cause losses without affecting payment systems or conventional office IT. For food retailers, restaurants, warehouses and manufacturers, refrigeration controllers can directly influence product safety, availability and trading operations.
Remote access is often necessary because specialist contractors maintain these systems. That arrangement can also create hidden exposure if controllers are directly reachable from the internet, accounts are shared, or supplier access is not monitored.
Actions for refrigeration system operators
Organisations should first identify which controllers, gateways and remote maintenance platforms manage refrigeration across their sites. Checks should focus on the specific failure patterns reported in Belgium, including unexpected defrost activation, altered setpoints and unexplained temperature increases.
-
Remove direct internet exposure from refrigeration management interfaces and require controlled, authenticated remote access.
-
Use unique credentials for each organisation and supplier account, then disable access that is no longer required.
-
Separate refrigeration controllers from point of sale, office and guest networks to limit movement between systems.
-
Enable alerts for setpoint changes, prolonged defrost cycles, unusual logins and access outside approved maintenance windows.
-
Ask refrigeration suppliers which controller models and software versions are installed, then review relevant vendor security bulletins.
Until Delhaize or an appropriate authority publishes technical findings, organisations should avoid assuming a particular product is responsible. The most useful immediate response is to verify exposure, review access records and ensure operational teams can respond quickly to unexplained temperature changes.
Originally reported by RetailDetail EU.
