Europe: A cyberattack targeting supermarket refrigeration and freezer systems has spread across several European countries, forcing retailers to discard large quantities of chilled and frozen food after temperatures in storage units rose sharply. The incident affected stores in Sweden, Belgium, Luxembourg and Ireland on Monday, November 2, and has raised fresh concerns about the vulnerability of essential retail infrastructure to cyber threats.
The attack reportedly affected supermarket groups including Ahold Delhaize and Colruyt in Belgium and Luxembourg, as well as Swedish grocery chains ICA and Coop. Furniture retailer IKEA also confirmed that at least one store in Belgium had been affected.
The incident follows a similar cyberattack in France last month, when hackers reportedly gained control of refrigeration systems at hundreds of supermarkets, resulting in food losses and fires. Investigators have not established whether the latest attacks are connected to the French incident or identified those responsible.
Supermarket freezers hit by overnight attack
The latest incident was discovered at different stores after refrigeration and freezer units were remotely tampered with, causing their temperatures to rise and making food stocks unsafe for sale.
At an ICA franchise store in Stockholm, sales manager Engla Ingwall told Reuters that the attack occurred at around 2 am local time but was noticed only several hours later. The store’s freezers had reportedly reached temperatures of 50 degrees Celsius.
“Everything is destroyed,” Ingwall said during a visit to the affected store on Monday.
She added that the temperature increase had ruined the food kept in the freezers, leaving the store with substantial losses.
A spokesperson for privately held Swedish retailer ICA confirmed that the company was aware of an overnight incident affecting a limited number of stores. The spokesperson said the incident had disrupted refrigeration and freezer systems.
The exact number of affected locations across all the countries has not been established. However, statements from retailers indicate that the disruption extended beyond a single supermarket group or national market.
Major retailers report refrigeration disruptions
Several European retailers have confirmed that their stores were affected by the incident.
Colruyt Group, which operates Spar outlets in Belgium through a franchise system, said five shops had experienced attacks on their refrigeration systems.
In Ireland, wholesaler Musgrave reported that the incident affected systems in 13 of its SuperValu stores. The company was forced to remove certain chilled and frozen products from sale as a precaution.
“Our monitoring systems alerted us to the issue and we took immediate action,” Musgrave said in a statement, adding that its investigation was continuing.
Swedish grocery chain Coop also reported unauthorised interference with refrigeration systems at seven of its approximately 800 stores. The company confirmed that Danfoss was among its refrigeration technology suppliers.
Carrefour, which suffered significant disruption during the previous month’s incident in France, said 15 of its 700 stores in Belgium were affected. IKEA separately confirmed that one Belgian store had experienced an impact, while saying it could not rule out disruption at other locations.
The incidents demonstrate how a cyberattack on a relatively specialised part of a supermarket’s operations can affect food storage, retail activity and supply chains.
France attack raises concerns about repeated incidents
The latest disruption has drawn attention because it resembles an incident reported in France last month.
French police said hackers had seized control of cooling units at hundreds of supermarkets, leading to fires and food losses. The attack affected refrigeration infrastructure used by retailers, highlighting the potential consequences of remotely accessing systems that control essential equipment.
Ahold also reported a cybersecurity incident to police last month. However, there is no confirmed evidence establishing a connection between that report, the French attack and Monday’s incidents.
At least some of the refrigeration units affected in the latest attacks used temperature-control technology supplied by Danish company Danfoss. The same company’s technology was also targeted during the French incident.
Danfoss said it had been working with customers to implement fixes following the attacks.
Neither of the incidents has been publicly claimed by a group or individual. Reuters reported that it could not establish who was behind Monday’s attacks or whether they were linked to the earlier disruption in France.
European authorities warn about infrastructure vulnerabilities
The attacks have increased concerns among European authorities about the security of infrastructure that can be controlled through internet-connected systems.
From refrigeration equipment and heating systems to security cameras and alarms, many devices that were once largely mechanical can now be monitored and operated remotely. While this technology can improve efficiency and allow businesses to manage multiple locations, it also creates potential entry points for cybercriminals.
Katrien Eggers, spokesperson for Belgium’s Centre for Cybersecurity, said the identity of those responsible remained unknown and might never be established.
She also expressed concern about the growing number of incidents and the potential role of artificial intelligence in cyberattacks.
“All IT systems are potentially vulnerable, and AI can now be used to successfully exploit these weaknesses — especially by sophisticated actors,” Eggers said.
The European Commission also warned that the attacks could have consequences beyond individual retailers.
EU Commissioner for Agriculture Christophe Hansen described the incidents as deliberate attempts to disrupt the food supply chain and undermine consumer confidence. He said the repeated occurrence of such attacks was deeply concerning.
European authorities have increasingly focused on hybrid threats to infrastructure since Russia’s invasion of Ukraine in 2022. However, no evidence has established Russian involvement in the supermarket incidents.
Moscow has repeatedly denied accusations of involvement in sabotage or hybrid warfare operations.
Cybersecurity experts explain why supermarkets are vulnerable
Cybersecurity researchers say retail chains can be attractive targets because of the large number of connected devices they operate across different locations.
Tom Hegel, a researcher at cybersecurity firm SentinelOne, said attacks on refrigeration and other retail systems could be motivated by extortion, political objectives or nation-state operations.
He noted that the absence of financial demands in recent incidents could indicate sabotage rather than a conventional ransomware operation, although the motive behind the latest attacks has not been established.
According to Hegel, supermarket chains manage extensive networks of refrigeration controllers, building management systems, access panels and point-of-sale equipment.
These systems often operate across numerous stores, making it challenging to monitor and secure every connected device.
He also highlighted the difficulty of tracing attackers who gain access through exposed control panels. Such access can leave limited evidence, making it difficult for investigators to distinguish between different types of perpetrators.
The growing use of connected technology in retail has therefore created a security challenge that extends beyond conventional computer networks. Equipment responsible for maintaining food safety can also become a target if remote access and security controls are not adequately protected.
Belgian businesses count the cost of spoiled food
The financial consequences have been particularly severe for some smaller businesses.
Luc De Laet, founder and owner of Belgian butchery chain De Laet & Van Haver, said he was woken at around 3.30 am by an employee who reported a problem at one of the stores south of Antwerp.
When he reached the premises, he found that the refrigeration units had been turned up to temperatures as high as 18 degrees Celsius.
De Laet estimated that the incident had destroyed approximately €15,000 worth of meat, equivalent to around $16,800.
He said the hackers appeared to have accessed the system responsible for recording and controlling temperatures, allowing them to alter the settings remotely.
“It’s very scary. They are hacking the system that is doing the registration of the temperature, and they can program it at a distance,” he told Reuters.
De Laet said he was angry about having to discard so much food and believed the attackers were attempting to destabilise European economies. He had contacted the police but did not know whether an investigation had been launched.
His experience highlights the impact such attacks can have on independent businesses, which may not have the same financial resources or technical infrastructure as large supermarket groups.
Investigations continue as retailers assess losses
Retailers and cybersecurity authorities are continuing to investigate the incidents and assess the damage. Companies have not confirmed the full extent of the food losses or identified the individuals responsible.
The attacks also raise questions about how businesses can protect equipment that is increasingly connected to remote monitoring and control systems. Securing refrigeration networks, limiting unauthorised access and improving monitoring could become important priorities for supermarket operators.
For consumers, the immediate impact has been the removal of affected chilled and frozen products from sale. However, the wider concern is the possibility that cyberattacks could disrupt essential services without directly targeting conventional computer systems.
With similar incidents reported in France and several other European countries, authorities and retailers face growing pressure to strengthen the cybersecurity of food storage and distribution infrastructure. Until the attackers are identified and the vulnerabilities addressed, the possibility of further disruption remains a concern.