Four countries appeared on two very different maps: the geography of Europe’s data-center boom and the geography of a spreading attack on supermarket freezers. The overlap is striking. But what, exactly, does it tell us?
On November 2, 2026, retailers across Europe reported refrigerators and freezers warming after suspected or confirmed interference with connected control equipment. Belgium, Sweden, Ireland and the Netherlands were among the affected countries. All four also happen to be central to Europe’s hyperscaler-owned data-center industry. In a February report, commercial-property researcher CBRE said those four nations held approximately 60% of Europe’s operating hyperscaler self-build capacity as of the end of 2025. Later research placed their combined share at around 70% by the second quarter of 2026, according to Data Center Dynamics’ account of CBRE’s August figures.
That is a genuine geographical intersection, and it gives a widely shared Instagram commentary video an interesting question to ask. The speaker is comparing where data centers are concentrated with where supermarket refrigeration systems were attacked; he is not necessarily alleging that the affected freezers were located inside data centers. The distinction matters. So does what happened after the video began circulating: on November 5, five U.S. government agencies issued a joint warning about cyber activity targeting industrial refrigeration worldwide.
Here is the line between evidence and theory: the attacks on refrigeration controllers are documented; the data-center footprint is documented; a causal connection between the two has not been established.
The four-country coincidence is not imaginary
The clearest evidence is not a speculative map but CBRE’s research. In February 2026, CBRE identified Ireland, the Netherlands, Sweden and Belgium as hosting roughly 60% of operational European capacity built and used by major hyperscale operators. By August, CBRE expected Europe’s overall data-center capacity to reach 13 gigawatts by year-end; reporting on its second-quarter figures put the four-country share of operational self-build capacity closer to 70%. These are capacity measures—not counts of buildings, employees, or attacks.
Then came the freezer incidents. Euronews’ November 3 country-by-country review listed Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden among the nine countries reporting refrigeration problems on November 2. France had experienced a separate, earlier wave in October.
| Country | Refrigeration incident evidence | Data-center comparison |
|---|---|---|
| Belgium | Multiple grocery chains affected; Carrefour reported 15 stores and Delhaize several dozen | One of CBRE’s four major hyperscaler self-build countries |
| Sweden | ICA and Coop stores reported problems; some retailers discarded frozen food | One of the same four countries |
| Ireland | Musgrave reported problems at 13 SuperValu stores | One of the same four countries; data centers used 23% of Irish metered electricity in 2025 |
| Netherlands | Smaller shops reported refrigeration incidents | One of the same four countries; Amsterdam is also a major European data-center market |
| Estonia, Finland, Italy, Luxembourg, Portugal | Various incidents or investigations reported on November 2 | Not among the four countries in CBRE’s concentrated hyperscaler self-build grouping; their inclusion complicates a four-country explanation |
| France | A major earlier wave was reported in October | Also a significant data-center market, but not one of the four countries in the specific CBRE self-build statistic |
Sources: Euronews/AFP country reporting; CBRE; Ireland’s Central Statistics Office. Reported involvement differs by chain and country; a reported malfunction is not automatically a confirmed intrusion in every store.
There are important counterexamples to a simple story. France saw a large earlier wave; the Netherlands reported a comparatively small number of incidents even though it is a data-center hub. Germany and the United Kingdom, which host two of Europe’s largest conventional colocation markets, were not included in Euronews’ initial November 2 list of nine countries. This does not disprove an intentional selection theory, but it means the four-country match alone cannot establish it.
Why 54 and 36 are not proof that data centers were attacked
The Instagram clip cites numbers for Belgium and Sweden in a discussion of data centers. Facility counts change depending on the directory, what it counts, and whether proposed sites are included. A 2026 DC Market Insights tracker lists 36 Swedish data-center facilities. The same tracker lists 34 Belgian facilities, with 54 megawatts of disclosed operational capacity. Another directory, Datacenter Atlas, records 47 Belgian data centers plus network points of presence. In short, a building count is not a megawatt measurement, and a directory total is not an attack tally.
There is no verified finding that dozens of data centers in Belgium or Sweden had their cooling systems hacked in these incidents. The established victims were primarily grocery refrigeration installations. Mistaking a national data-center total for a count of breached facilities would change the meaning of the story.
The strongest documented connection is remote-control technology
France’s national cybersecurity response team, CERT-FR, issued an alert on October 12 identifying compromises involving Danfoss AK-SM and AK-SC refrigeration controllers and Copeland/Dixell xweb systems. These devices are designed to manage physical cooling processes. When their administrative interfaces are exposed to the internet or poorly secured, an unauthorized person may be able to change operating settings remotely.
In some of the reported incidents, settings were driven as high as 50°C (122°F); that does not prove every freezer interior or food item physically reached that temperature. Retailers withdrew stock as a precaution or because their cold chain had been compromised. Reuters and the Associated Press documented the disruption.
Data centers, meanwhile, also depend on extensive cooling, monitoring, electrical and automation systems. There is a legitimate security analogy between digital controls operating physical infrastructure in both settings. But analogy is not a shared breach. No cited investigation has shown that Europe’s data-center expansion caused the grocery controller compromises, that the same systems were attacked, or that attacks traveled through data centers into retail freezers.
The hardware and network path matter much more than two countries sharing a map color. A supermarket controller can be attacked through its own exposed management interface without anyone touching a regional power grid—or a nearby data center.
A fresh U.S. warning changes the stakes
On November 5, 2026, the U.S. Cybersecurity and Infrastructure Security Agency, FBI, and departments of Health and Human Services, Agriculture, and Transportation published a joint three-page advisory on malicious cyber activity targeting industrial refrigeration and cold-chain monitoring systems worldwide. It identified potential techniques including authentication bypass, code injection and weak configurations, and warned of temperature changes, inventory losses, reduced equipment life, fire hazards and loss of visibility into readings.
The advisory addresses healthcare and medicine, chemicals, food and agriculture, and transportation—not just supermarkets. This is the expansive, credible concern behind the viral video’s anxiety: a system meant to make physical infrastructure easier to manage can also become a way to interfere with it when poorly secured.
The advisory did not link the attacks to European data-center construction or describe a coordinated plan for universal connection to a global grid by 2030. Nor was it evidence that data centers themselves had been disabled. It was a warning about internet-accessible industrial refrigeration controls.
There is also an earlier U.S. thread. Reuters reported on October 29 that Pentagon investigators were treating August freezer malfunctions at military commissaries as suspected cyberattacks. That investigation establishes a reason to scrutinize a wider pattern of cold-chain disruption. It does not establish the same perpetrators or a coordinated test targeting data-center hubs.
What a real correlation study would have to show
To test whether attackers deliberately focused on data-center-heavy locations, researchers would need more than a list of countries. They would need dated geographies of affected stores, not just nations; a consistent measure of data-center concentration by city or region; counts of vulnerable refrigeration controllers; the number of grocery outlets in each location; and comparable information from areas that were not affected.
Then investigators could ask whether attack rates remained higher near data-center clusters after accounting for the density of supermarkets, the same refrigeration vendors, connectivity, and differences in reporting. Evidence of shared attack infrastructure, technical indicators, targeted suppliers or attacker communications would be even more informative. None of those causal tests appears in the viral clip.
There is a basic statistical trap here: large, highly connected economies tend to host both data centers and lots of networked businesses. Observing both in the same nation can reflect a third factor—digital infrastructure—rather than a plot involving one sector attacking another.
The real warning: digital convenience becomes a physical vulnerability
The U.S. agencies recommend removing industrial controllers from the public internet, separating operational technology from corporate networks, enforcing strong authentication, patching or replacing unsupported equipment, reviewing logs, and imposing sensible temperature setpoint limits. The official document also recommends testing backups and alerting on unexpected changes.
For the public, the long-term stakes involve food safety, medicine storage, logistics, energy and confidence in everyday services. For operators, the challenge is ensuring connected equipment can fail safely and be controlled locally when outside network access is compromised. Those vulnerabilities deserve attention whether an attack occurs in a data-center hotspot or in a small town far from one.
The geographic overlap deserves a map, a proper denominator and an investigation—not a dismissal, and not a premature verdict. If four European data-center hubs were also hit by freezer attacks, were they selected for what they host, or were they simply among the places where vulnerable refrigeration controls were easiest to reach?
Watch and verify
Event reporting: Euronews’ November 2 video report documents the European supermarket incidents. Commentary under examination: the original Instagram video compares countries and proposes a wider theory; its commentary is not independent evidence that data centers were hacked.
Primary and supporting documents: U.S. government joint cold-chain cybersecurity advisory, November 5; CERT-FR refrigeration controller alert, October 12; CBRE’s hyperscaler capacity research; Irish government data-center electricity statistics.
Earlier Apep Bar coverage: Hackers Turned Supermarket Freezers Up to 50°C. Europe’s Cold Chain Has a Security Problem, which details the initial retailer reports and technical response.
Featured photograph: Chad Davis / Wikimedia Commons, CC BY 2.0, showing an actual Google data-center campus at Council Bluffs, Iowa, in 2017. Contextual photograph of data-center infrastructure; neither the photographed facility nor Google is implicated in the European freezer incidents. Photo source and licensing.
.jpg){kind=link}