Belgian Supermarket Cyberattack Investigated in Brussels 2026

Brussels (Brussels Morning Newspaper) November 02, 2026 – The Federal Public Prosecutor’s Office in Belgium has launched a formal criminal investigation following a widespread cyber incident that disrupted the operational refrigeration and freezer systems of multiple supermarket chains across the country. The security breach hit at least 40 Delhaize branches, 15 Carrefour outlets, five Spar locations operating under the Colruyt Group, and 10 to 15 Intermarché stores situated in Brussels and Wallonia. National cyber security authorities have confirmed the event, noting that the origin and precise motives of the perpetrators remain unverified while technical investigations proceed.

Federal Public Prosecutor’s Office Opens Formal Investigation

The Federal Public Prosecutor’s Office confirmed on Monday that it has formally initiated a criminal investigation into the targetted disruption of industrial cooling systems across Belgian retail outlets. A spokesperson for the prosecutor’s office verified the opening of the file following consecutive reports from retail operators and national security bodies.

Federal law enforcement authorities have not publicly disclosed specific details regarding potential suspect groups, digital forensic indicators, or potential vectors of access used to compromise the targetted retail infrastructure. Judicial authorities confirmed that technical experts are reviewing systems data to identify the operational mechanisms behind the disruption.

Multiple Retail Chains Disrupted Across Flanders, Wallonia, and Brussels

The operational disruptions were initially detected overnight between Sunday and Monday, affecting store networks across Flanders, Wallonia, and the Brussels-Capital Region. Retail networks reported irregular temperature rises across in-store refrigeration units and commercial freezers, forcing store personnel to take immediate mitigation measures.

Public broadcaster VRT News reported that the operational disruption impacted at least 40 Delhaize locations, largely consisting of Proxy Delhaize outlets, Shop & Go convenience stores affiliated with Q8 service stations, and select integrated supermarkets. A spokesperson for Delhaize confirmed the occurrence of an IT incident affecting refrigeration units in its store network while technical teams worked to stabilize system controls.

Carrefour Belgium confirmed that approximately 15 of its stores across Flanders and Wallonia experienced refrigeration failures on Monday morning. Operational staff at affected branches moved to inspect chilled and frozen inventory, while technical specialists initiated system diagnostics to evaluate the scope of the infrastructure compromise.

Additionally, Spar—operating as part of the Colruyt Group—reported cooling anomalies at five store locations. In Wallonia and the Brussels region, between 10 and 15 Intermarché branches were similarly affected by localized cooling failures.

Remote Defrost Overrides Force Product Disposal and Emergency Logistics

The incident reportedly involved the unauthorized remote manipulation of industrial cooling controls. Systems were manipulated to switch evaporators and cooling units into forced defrost modes overnight.

This unauthorized modification of control settings caused ambient temperatures inside commercial refrigerators and freezers to increase significantly, rising to approximately 15°C in several instances. Because storage temperatures exceeded legally mandated food safety thresholds, affected retailers were forced to discard substantial volumes of perishable items, including meat, dairy, and frozen products, to protect public safety.

Store personnel responding to early-morning automated system alerts implemented emergency containment protocols. In several locations, retailers deployed mobile refrigerated transport units to store uncompromised inventory and mitigate financial losses. Distribution networks and main logistics warehouses operated normally throughout the incident, with primary supply chains remaining unimpacted.

Centre for Cybersecurity Belgium Evaluates Threat Profiles and Vulnerabilities

The Centre for Cybersecurity Belgium (CCB) confirmed its ongoing assessment of the incident in coordination with affected commercial operators and law enforcement authorities. Miguel De Bruycker, Director of the CCB, highlighted the complex challenges inherent in establishing clear threat actor attribution during the early stages of a digital investigation.

“In the past it has become clear that it is difficult to determine why hackers carry out cyberattacks,” stated De Bruycker.

De Bruycker outlined three primary threat actor categories typically associated with major infrastructure and commercial attacks:

1. Financially Motivated Criminals: Cybercriminals operating extortion schemes, ransomware, or direct financial theft.

2. State-Sponsored Actors: Advanced persistent threat groups operating on behalf of nation-states to achieve strategic objectives or disseminate disinformation.

3. Hacktivists: Ideologically motivated individuals or groups seeking public visibility due to dissatisfaction with social, political, or economic developments.

The CCB emphasized that available evidence does not currently assign the supermarket cooling disruption to any specific threat category, as no public claims of responsibility or ransom demands have been formally published.

National Cyber Director Highlights Sectoral Vulnerabilities Beyond Finance

The disruption of supermarket cooling units has focused broader attention on operational technology (OT) vulnerabilities within essential consumer sectors. Industrial refrigeration management software relies on networked building management systems and internet-connected controllers, which enable remote maintenance by third-party technical vendors.

Addressing the shifting landscape of cyber threats, De Bruycker observed that risk exposures extend far beyond traditional targets like banking infrastructure.

“For a very long time, the blind spots were in the financial sector, but now we’re also seeing major concerns in other sectors. Just think of the transport or telecoms sectors,” De Bruycker noted. “Imagine if they suddenly brought the internet to a standstill or took control of certain telephone connections.”

Cyber security monitoring bodies noted an accelerated frequency of targeted operational disruptions across European industrial controls over recent months. Technical investigations led by federal prosecutors and specialized cyber forensic teams remain ongoing as retailers restore affected cooling systems to standard operational parameters.