Cyber-Attack Targets Supermarket Refrigeration Systems Across Seven European Countries

A suspected cyber-attack hit dozens of supermarkets across seven European countries overnight, taking remote control of commercial cooling systems and forcing refrigerators and freezers into defrost mode.

The incident affected grocery stores and butcher shops in Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia, and Finland. Hackers reportedly altered the operational settings of connected cooling units, causing internal temperatures in some freezers to climb as high as 50°C (122°F). The sudden temperature spikes resulted in millions of euros worth of spoiled produce and forced several stores to temporarily close.

The overnight event mirrors a similar cyber-attack in France last month, where hackers gained control of cooling units across hundreds of grocery stores, leading to food spoilage and localized electrical fires.

Stephan Moelans, CEO of Belgian refrigeration firm Sabcobel, confirmed the nature of the breach to local media:

"I've been awake since 2 a.m. We've been working all night and morning to disconnect the affected units from the network.”

The attack hit major retail chains and independent shop owners across the region:

• Belgium and Luxembourg: Approximately 40 Delhaize stores, 15 Carrefour locations, and five Spar shops operated by Colruyt Group experienced temperature breaches. In Flanders, a single Delhaize branch in Hoeilaart reported losing €100,000 (£83,500) in spoiled inventory.
• Sweden: Retailers ICA and Coop reported disruptions across multiple locations. Engla Ingwall, sales manager at an ICA franchise in Stockholm, stated: "There has been a cyberattack and all our freezers reached 50 degrees (Celsius)... Everything is destroyed." Additionally, retailer Axfood reported that freezers at a home delivery distribution hub in Gothenburg were compromised.
• Ireland: Food wholesaler Musgrave confirmed that 13 SuperValu stores suffered cooling disruptions affecting a specific model of commercial refrigerator, forcing staff to pull chilled items from shelves.
• Netherlands and Estonia: Danish manufacturer Danfoss reported that cooling networks at 17 Dutch businesses including local butcher shops were hit, while technology supplier Kitman Coldtech reported that an Estonian chain saw unit temperatures remotely altered to 50°C.
• Finland: Refrigerator malfunctions linked to the incident were detected across several K-stores.

National cyber-security agencies in Belgium, Sweden, and the United Kingdom confirmed they are actively investigating the incident. No refrigeration attacks have been reported within the UK.

John Billow, head of Sweden’s national cyber-security centre, noted the vulnerability of connected operational equipment across retail supply networks:

“We have in recent weeks... identified we have quite a lot of exposed operational technology devices in Sweden that we have been clear about the necessity to update or patch.”

Cyber-security researchers noted that because no ransom demands were made, the incident likely represents targeted economic sabotage rather than a typical financial extortion scheme. Tom Hegel, a researcher at SentinelOne, observed:

"Retail is an easy target because retail chains run enormous estates of refrigeration controllers, building management systems, door access panels and point-of-sale gear. Grocery margins are thin and stock perishes within hours, so any disruption hurts quickly and in public."

Addressing the broader risks, a European Commission spokesperson stressed:

“These incidents show that cyberattacks can disrupt services, affect businesses and directly affect citizens’ daily lives.”

A spokesperson for The Centre for Cybersecurity Belgium added that identifying perpetrators behind AI-driven operational technology breaches remains a challenge, saying: “We may never be able to identify … who is behind this attack”.