Refrigerators and freezers in supermarkets across at least seven European countries reportedly had their temperatures raised to as high as 50°C overnight. The incidents have raised fresh concerns about the security of Europe’s food supply chain, following a similar cyberattack in France last month that caused millions of euros in damage.
Supermarket chains in Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden reported problems with their refrigeration systems on Monday. Several retailers confirmed that their stores had been targeted by cyberattacks.
The EU’s food and agriculture commissioner, Christophe Hansen, described the repeated incidents as deeply concerning. He called them “a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it”.
The latest reports follow an attack in France last month, when hackers took control of cooling units in as many as 700 supermarkets. Temperatures were raised to as high as 50°C (122°F), causing fires and food losses estimated at tens of millions of euros.
Supermarket Chains in Sweden Report Damage
Swedish supermarket chain Coop told the newspaper Aftonbladet that six of its stores had been affected. Rival retailer ICA said it was aware that a limited number of stores had experienced an overnight incident affecting their refrigeration and freezer systems.
An ICA store in Sjöbo, southern Sweden, reported that its fridges and freezers had been hacked and their temperatures set to 50°C. Another store in Stockholm said its freezers had been damaged in a “2am cyberattack” and that “everything was destroyed”.
John Billow, head of Sweden’s National Cybersecurity Centre, said the organisation was working on incidents reported across the country.
He told Reuters that authorities had identified a significant number of exposed operational technology devices that needed security updates or patches.
Dozens of Shops Affected in Belgium and Luxembourg
Dutch retailer Ahold Delhaize said fridges and freezers in dozens of its supermarkets in Belgium and Luxembourg had been affected. The company had reported a similar incident to police in the Netherlands last month.
Although the retailer did not specify the cause of the latest disruption, reporters visiting a shop north-east of Brussels found empty refrigerators and freezers. A notice at the store said: “Due to cyberattacks, there will be no products on the refrigerated or freezer shelves. We offer our sincere apologies.”
Company spokesperson Sarah De Meester said the range of fresh and frozen products available in affected stores was temporarily limited. However, distribution centres were operating normally and deliveries had not been disrupted.
Belgian newspaper Le Soir reported that dozens of shops and supermarkets had been affected, including five Spar outlets, Shop & Go convenience stores attached to Q8 service stations and several smaller Proxy Delhaize stores.
Stephan Moelans, chief executive of Sabcobel, the company responsible for operating Delhaize’s refrigeration systems, told the newspaper that technicians had been mobilised from 1am.
“We spent all night and morning disconnecting the affected installations,” he said.
He told the Belga news agency that the incident was a cyberattack and that the units’ evaporators had been switched into defrost mode.
Other supermarket chains also reported problems. Colruyt said five of its stores had experienced technical issues affecting refrigerators, while Intermarché reported problems in 15 stores. Carrefour Belgium said around 15 of its 700 shops had been affected.
Carrefour spokesperson Mich Vergauwen said: “It’s a cyberattack, there is no other reason.”
An Ikea Belgium spokesperson also told Agence France-Presse that a cyberattack had caused the temperature of freezers in its Mons store to rise suddenly.
Ikea said it had removed some food products from refrigeration units as a precaution and expected some food waste as a result.
Problems Also Reported in Finland, Estonia and Ireland
In Finland, newspaper Helsingin Sanomat reported that shops operated by supermarket chain Kesko were investigating similar problems.
Dutch public broadcaster NOS said the systems of at least 17 shops, mainly small local retailers, had been affected.
In Estonia, attackers accessed a computer controlling a supermarket’s refrigeration system and raised the temperature to 50°C, according to refrigeration supplier Kitman Coldtech, which spoke to broadcaster ERR.
“This is very fresh, it happened this morning,” said the company’s chief executive, Jann Mutso. He added that the incident had been dealt with within minutes and that there had been no significant damage.
Estonian supermarket chain Selver confirmed that one of its stores had been affected.
Ireland’s third-largest supermarket chain, SuperValu, said refrigeration systems using a specific model had been affected in 13 of its 223 stores. Chilled and frozen products had been removed from sale.
Who Is Behind the Attacks, and Why?
Tom Hegel of cybersecurity firm SentinelOne said many cyberattacks involved extortion or political motives and could be carried out by state-level actors.
However, the absence of financial demands in the supermarket incidents suggested that sabotage could be the objective, he said.
“Retail is an easy target because retail chains run enormous estates of refrigeration controllers, building management systems, door access panels and point-of-sale gear,” Hegel told Reuters.
Patrick Lamplmair of cybersecurity firm Tributech said attackers were likely to continue using the method “until it stops working”, because it was cheap and caused immediate damage.
Many refrigeration systems still had known security vulnerabilities that had not been fixed, he said.
“Thousands of these controllers were still reachable from the internet after the French attack,” he added. “A few commands to a temperature controller can destroy stock overnight and close stores.”
French Attack Caused Millions of Euros in Losses
In last month’s French attack, hackers compromised controllers supplied mainly by Danish company Danfoss.
The company later said it had identified some security weaknesses the previous year and had “long recommended” that customers install software updates.
The attackers remotely changed the settings of thousands of freezers, refrigerators and chiller cabinets at supermarket chains including Intermarché, Coopérative U, Carrefour, Leclerc and Monoprix.
Temperatures were pushed from as low as -27°C to well above 50°C.
Supermarkets were forced to discard large quantities of fresh meat, dairy products and frozen food. Individual stores reportedly suffered losses ranging from tens of thousands of euros to more than €130,000 (£109,000).
The Paris prosecutor’s office has opened a formal investigation into the French attack. Prime minister Sébastien Lecornu also instructed France’s national cybersecurity agency, ANSSI, to investigate.
The agency subsequently reported that supermarkets using controllers made by two other companies had also been targeted. However, authorities have not identified who may have been behind the incidents, and no group has claimed responsibility.
Growing Concerns Over Europe’s Cybersecurity
An increasing number of devices, including refrigeration systems, can now be monitored and controlled remotely. This has heightened concerns among European authorities about the possibility of state-sponsored hybrid attacks, particularly since Russia’s invasion of Ukraine in 2022.
The latest incidents have renewed questions about the security of supermarket infrastructure and the potential consequences for food supplies when essential systems can be accessed remotely.
