Supermarkets in several European countries are scrambling to contain the fallout from a wave of cyberattacks that have targeted their refrigerator and freezer systems, causing temperatures to spike and forcing the disposal of large quantities of food. The incidents, reported overnight and into today, have affected stores in Sweden, Belgium, Ireland, the Netherlands, Luxembourg, and Estonia, according to multiple sources including Reuters and national news agencies.
Retailers in the affected countries reported that hackers accessed refrigeration controls remotely, raising temperatures in some units to as high as 50 degrees Celsius. As a result, supermarket staff in locations such as Sjöbo, Sweden, and across Belgium were seen emptying freezers and discarding spoiled goods, with images circulating on social media and local news platforms.
According to Reuters, the attacks have hit major supermarket chains including ICA and Coop in Sweden, Delhaize, Carrefour, and Spar in Belgium, and SuperValu stores in Ireland. The Colruyt Group, which operates Spar stores in Belgium, confirmed that five of its shops had their fridge systems attacked. In Estonia, a refrigeration technology company reported that hackers accessed a computer controlling a client’s system, also resulting in a temperature surge to 50 degrees Celsius.
Stephan Moelans, CEO of Belgian refrigeration company Sabcobel, told the Belga news agency that the cyberattack began around midnight, with technicians working through the night to disconnect affected units from networks. “We’ve been working all night and morning to disconnect the affected units from the network,” Moelans said, describing the incident as a clear cyberattack after fridge and freezer evaporators were switched into defrost mode.
While the precise number of affected stores remains unclear, the scale of the disruption is significant. In Sweden, ICA Group spokesperson Gustaf Nilsson said only a “limited number” of stores were impacted, but did not provide specific figures. In Ireland, the Musgrave Group confirmed that more than a dozen SuperValu stores were hit, leading to precautionary removal of chilled and frozen products from sale.
This wave of attacks comes just weeks after a similar incident in France, where hackers remotely manipulated refrigeration systems in hundreds of supermarkets and independent stores, causing widespread food spoilage. According to SupplyChainBrain, the French incidents targeted fridge and freezer controllers supplied by Danish company Danfoss, which are commonly connected to the internet for remote monitoring and maintenance.
Cybersecurity experts say retail chains are particularly vulnerable due to their extensive use of internet-connected building management systems, including refrigeration controllers. Tom Hegel, a researcher at SentinelOne, told Reuters that such attacks are typically linked to extortion, political motives, or nation-state operations. However, he noted that the absence of financial demands in these recent cases suggests sabotage rather than ransom as the likely motive.
No group has publicly claimed responsibility for the attacks, and investigations are ongoing. Authorities and affected companies are working to restore systems and assess the full extent of the losses. The incidents have raised concerns about food security and the resilience of critical infrastructure in the retail sector.
Why it matters
The latest cyberattacks on supermarket refrigeration systems highlight the growing vulnerability of essential retail infrastructure to digital threats. According to Reuters and SupplyChainBrain, the attackers exploited internet-connected controllers widely used for remote maintenance, exposing a weak point in the supply chain that affects both food safety and business continuity.
These incidents have forced major retailers such as ICA, Coop, Delhaize, and SuperValu to discard large quantities of food, underscoring the direct economic impact on businesses and the risk of food shortages at the consumer level. The attacks also follow a similar pattern seen in France last month, suggesting a coordinated or copycat approach that could continue to threaten supermarkets across Europe and beyond.
With no group claiming responsibility and no clear financial motive, the attacks raise questions about the intent behind targeting food supply infrastructure. As cybersecurity experts like Tom Hegel of SentinelOne point out, the retail sector’s reliance on connected systems makes it an “easy target,” and the lack of attribution complicates efforts to prevent future incidents. Authorities and companies will likely face increased pressure to strengthen digital defenses and review the security of critical systems in the wake of these events.
The image accompanying this article is an AI-generated illustrative depiction inspired by the actual scene of the event.
