In Belgium, Stephan Moelans, CEO of the refrigeration installer Sabcobel, said the incident began around midnight on Sunday. The attackers remotely switched the units' evaporators to defrost mode, which made the units warm up. Ahold Delhaize described an IT incident that raised refrigeration temperatures at dozens of its Delhaize stores in Belgium and Luxembourg, with one count putting the number near 40. Carrefour confirmed 15 affected stores in Flanders and Wallonia, Colruyt five, and five Spar stores were also hit, along with the IKEA store in Mons. A store manager estimated that at least €60,000 ($67,283) of food was thrown out at one location.

Sweden reported the most detailed accounts. Several ICA stores in Skåne, Öland, Värmland and Stockholm were affected, as were six Coop stores in Gästrikland and Hälsingland. At ICA Nära in Boda, store manager Mats Olsson found a freezer at 55C (131F) and water on the floor from units that had been switched off. Other ICA stores reported temperatures of 50C. The manager of an ICA Baronen store in Stockholm said the attack hit at 2 am and was noticed at 5:30 am. ICA press officer Gustaf Nilsson said the affected stores used connections outside the central network. John Billow, who leads Sweden's national cybersecurity centre, said it is investigating several incidents. "We have in recent weeks... identified that we have quite a lot of exposed operational technology devices in Sweden that we have been clear about the necessity to update or patch," he said.

In Ireland, Musgrave said 13 SuperValu supermarkets were affected because a specific refrigeration model was compromised, and chilled and frozen goods were pulled from sale. In Estonia, hackers got into a computer controlling refrigeration at a Selver supermarket and changed a freezer's temperature, and the chief executive of the refrigeration firm Kitman Coldtech said an Estonian chain saw temperatures reach 50C. Finland's Kesko reported temperature problems at a few K-food stores, and its security manager, Petri Kähkö, said a cyberattack had not been ruled out.

In the Netherlands, a spokesperson for the Danish equipment maker Danfoss said at least 17 businesses were affected, mostly butcher shops, small local grocers and storage facilities. Their temperature settings were changed. Major Dutch supermarkets, including Albert Heijn, were not hit. The spokesperson said the affected systems were not on a secure network and still used default passwords. Danfoss had told its Dutch clients on October 13 to disconnect from the internet and reconnect only through secure networks, and a small number did not. The spokesperson said the attack could have been prevented had they done so. Albert Heijn's parent company shut down its digital infrastructure for more than a week last month after hackers tried to breach it, but no evidence links that event to the refrigeration attacks.

Reports say the attacks targeted dozens of refrigeration systems made by Danfoss and Copeland, and one outlet reported that Danfoss disclosed critical vulnerabilities involving outdated firmware in September.

France was hit in a similar attack overnight on October 11-12. Reports put the number of affected sites at more than 400, and one said up to 700 supermarkets. They included about 150 stores run by Les Mousquetaires (Intermarché and Netto), nearly 100 Coopérative U outlets, and dozens of Carrefour and Monoprix stores. Police said temperatures were pushed as high as 50C, causing fires and food losses. Losses ran from tens of thousands of euros to more than €130,000 per store, and two supermarkets in Alsace reported a combined €270,000. The Paris prosecutor's office opened a preliminary investigation, and Prime Minister Sébastien Lecornu is personally monitoring the situation.

The timing of the French attack raised concerns about Russian hybrid operations, though no evidence has been established. A suspected cyberattack in late August also affected at least six US military commissaries, and the Army Criminal Investigation Division opened an inquiry, with US cyber investigators cooperating with French law enforcement.