
| Country | First confirmed | Stores/sites | Sector | Noted temp |
|---|---|---|---|---|
| France | Oct 12 2026 | 700+ | Supermarkets | Up to 80C |
| Belgium | Nov 2 2026 | Dozens | Delhaize, Carrefour, Spar, IKEA | ~50C |
| Sweden | Nov 2 2026 | 7 Coop + ICA stores | Supermarkets | 55C |
| Ireland | Nov 2 2026 | 13 | SuperValu | ~50C |
| Luxembourg | Nov 2 2026 | Several | Ahold Delhaize | ~45C |
| Estonia | Nov 2 2026 | 1 | Selver | 50C |
| Finland | Nov 2 2026 | Several | K-Group | ~50C |
| Netherlands | Nov 2 2026 | Confirmed | Multiple chains | Not disclosed |
| Portugal | Nov 2 2026 | Confirmed | Multiple chains | Not disclosed |
| Italy | Nov 2 2026 | ~20 | Coop Sicily and others | Not disclosed |
| Germany | Nov 4 2026 | 4 | Not disclosed | Not disclosed |
| Romania | Nov 4 2026 | 6 | Not disclosed | Not disclosed |
| United Kingdom | Nov 3 2026 | Several | Meat processors | Not disclosed |
Countries now confirmed affected
13 (11 EU plus UK and France)
Danfoss controllers exposed online across Europe
~4,500
Danfoss AK-SM 800 end-of-life
2016
Danfoss AK-SC 355 end-of-life
2021
Coop Sicily stores hit
4 of 300
Coop Sicily estimated damage
Thousands of euros per store
"These are not isolated incidents, and of course we have to be collectively resilient and prepared for such cyber incidents.
"Thomas Regnier - EU Commission spokesperson - 4 Nov 2026
What happens next
EU Commission agencies talking with national authorities on joint response (4 Nov 2026)
Belgium federal prosecutors criminal investigation open (2 Nov 2026)
France Paris prosecutors criminal investigation open (Oct 2026)
Italy government held emergency intelligence and cybersecurity talks (3 Nov 2026)
NCSC alerting vulnerable UK businesses with exposed Danfoss units (3 Nov 2026)
ENISA formal advisory on Danfoss controllers expected
Romania and Germany national cyber agencies to publish incident reports
Sweden and Ireland police investigations expected
Danfoss AK-SM 800 and AK-SC 355 have no patch path -- controller replacement required
Deloitte cybersecurity expert Frank Groenewegen advises: disconnect controllers from public internet immediately if status unknown
Sources: Al Jazeera (AFP and Reuters, 03:16 UTC 4 Nov 2026 -- EU response, Germany and Romania); BBC (ckq6ndq8l6v0o, 13:07 UTC 3 Nov 2026 -- UK meat industry and NCSC); NCSC Annual Review 2026 (ncsc.gov.uk/collection/annual-review-2026, primary source); Reuters (3 Nov 2026 -- Italy, Romania); Guardian (theguardian.com, 3 Nov 2026). No group has claimed responsibility; Romania's top cybersecurity official Dan Cimpean says the attack appears "semi-amateurish" and he does not suspect a state actor.