Cyber threats may no longer seem distant as hacker attacks have evolved beyond data theft, ransom demands, or online system outages to increasingly target systems controlling daily life and economic activities in the real world—from manufacturing and transportation to retail and public health services directly affecting people's lives.
The latest wave in Europe involves hackers breaching supermarket refrigeration control systems in multiple countries, remotely altering temperatures to spoil goods. Similar incidents then spread to plasma storage systems at France’s national blood bank, revealing that internet-connected technology vulnerabilities can cause more than just screen-level damage.
At the same time, economic impacts are becoming clearer asAhold Delhaizethe Netherlands-based retail giant estimates the incident could reduce Q4 sales by up to 250 million euros (approximately 9.4 billion baht) and operating profits by as much as 100 million euros (around 3.8 billion baht).
Although only part of the operating system’s devices were attacked, these figures underscore the significant economic costs cyber threats can impose and suggest potential damages could escalate to several billion baht.
The latest attacks occurred between 1-2 November 2026, following similar incidents first detected in France on 11 October. They have since expanded to retail outlets across more than 10 European countries, including Belgium, Sweden, Luxembourg, Ireland, the Netherlands, Finland, and Estonia.
Targets included not only small stores but also major supermarket chains and retailers such as Carrefour, Delhaize, ICA, Coop, SuperValu, and certain IKEA branches.
In Belgium, approximately 40 Delhaize supermarkets and retail stores were affected, alongside 15 Carrefour, 15 Intermarché, and 5 Spar locations. Sweden reported incidents in 23 ICA stores and 7 Coop outlets, while 13 SuperValu stores in Ireland were impacted.
Some locations experienced abnormal temperature spikes within refrigeration units; one ICA store in Stockholm reported temperatures reaching 50 degrees Celsius. A Belgian butcher estimated meat losses at about 15,000 euros (roughly 560,000 baht).
Although many stores remained open, they had to urgently remove potentially unsafe fresh and frozen foods, inspect cooling systems, and replace certain equipment to prevent recurrence. Beyond lost sales revenue, stores faced additional expenses for system inspections, repairs, and operational disruptions.
Another concerning incident occurred on 2 November 2026 when Établissement français du sang (EFS), France's national blood service, disclosed that its plasma storage temperature control systems at three sites were cyberattacked.
Reports indicate attackers manipulated temperature and defrost thresholds, attempting to raise set points from the normal approximately -30 degrees Celsius to as high as 110 degrees Celsius. However, the 110-degree figure reflects the value the attackers tried to input rather than confirmed actual temperatures within storage facilities.
These systems are critical for preserving plasma used in patient treatments and medication production, requiring strict temperature controls to maintain product quality and safety.
EFS confirmed their monitoring and alarm systems promptly detected anomalies, enabling staff to manage the situation and transfer plasma to secure storage in time.Just in time.This incidentresulted in no reported damage to blood products or impact on patients, with blood donation and distribution continuing as usual.
While plasma was unharmed, the case highlights distinct risks from attacks on medical supply control systems; undetected interference could jeopardize healthcare readiness and patient safety.
What makes this case notable is that targets were not customer databases, payment systems, or corporate websites but rather operational equipment control systems inside facilities.
Many commercial refrigeration units are now internet-connected to allow operators to remotely monitor temperature, performance, and manage devices. While such technology reduces operating costs, especially for retailers with multiple locations, it also creates new access points for attackers if security measures are inadequate.
Reports from Belgium indicate attackers forced devices into Defrost Mode, causing abnormal internal temperature rises. Previously identified vulnerabilities included direct internet access to control systems, use of outdated unpatched software, and weak security configurations.
In the French blood bank case, attackers did not access EFS’s main information systems directly but targeted cooling systems operated by external providers.
Coolworld, the refrigeration service provider involved, acknowledged cybersecurity issues, noting that reported vulnerabilities related to technology components from other suppliers.
This exemplifies third-party or supply chain cyberattacks, where organizations suffer from external providers' vulnerabilities despite their own systems remaining uncompromised. However, detailed technical information about the latest attacks remains undisclosed, so it's unclear if all incidents share the same vulnerabilities or perpetrators.
Following the ongoing incidents, on 4 November 2026 the European Commission and the EU Agency for Cybersecurity (ENISA) issued a joint statement confirming close monitoring of attacks affecting commercial refrigeration systems across member states.
They are coordinating with Europol and national cybersecurity agencies to share threat intelligence, identify vulnerabilities, and prevent further attacks.
So far, no perpetrators or motives have been confirmed, nor is there sufficient evidence that incidents across countries are linked. Notably, no ransom demands have emerged from the recent attacks, raising questions whether motives are non-financial, such as causing disruption or damage. However, this remains unverified.
The refrigeration system attacks come amid growing concerns over cybersecurity of critical infrastructure, following prior incidents disrupting real-world business operations.
In September 2025, ransomware attacks on Collins Aerospace’s check-in and boarding systems affected Heathrow (UK), Brussels (Belgium), and Berlin Brandenburg (Germany) airports, forcing some airlines to revert to manual check-ins and causing flight delays.
Around the same time, UK car manufacturer Jaguar Land Rover faced cyberattacks thathalted production lines, impactingoperations and supply chain businesses.
ENISA’s 2026 Threat Landscape report analyzing 2025 European cyber incidents found government agencies were most targeted (32%), followed by service industries and transport (8% each), manufacturing (7%), and finance/banking (6%).
Furthermore, 73% of targeted organizations are classified as essential or critical under the EU’s NIS2 Directive, indicating cyber threats increasingly endanger services and economic activities upon which daily life depends.
A common thread among these events is reliance on digital systems and third-party technology providers, which enhance business efficiency but allow a single vulnerability to impact multiple organizations or countries. This is especially true for Internet of Things (IoT) and Operational Technology (OT) systems connecting digital networks to real-world control devices—from refrigerators and factory machinery to transport systems and medical equipment.
The European supermarket and blood bank cases illustrate that cyberattack damage extends beyond data leaks or system outages to affect goods, revenues, business continuity, and public safety directly.
The key question for businesses is not only how to prevent hackers from accessing data but also how to prepare for attacks on digital systems that control real-world operations. A single cybersecurity flaw can cause economic harm far exceeding many organizations’ expectations.
Source: Reuters [1] , BBC , AP , ENISA , The Hacker News
For economic and government policy news with ThairathMoney to help you achieve "Good Finance, Good Life," visit
Follow the Facebook page: Thairath Money at this link https:// www.facebook.com/ThairathMoney