Cyber-Attacks Force Temperature Spikes in Supermarket Freezers Across Seven European Nations

Disruption Across Seven European Retail Networks

Supermarket chains in seven European countries reported overnight disruption to store cooling infrastructure on Monday, after unauthorized intrusions forced temperature settings in commercial refrigerators and freezers to rise to as high as 50C (122F). The incidents affected grocery outlets, convenience stores, and furniture retail food halls in Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands, and Sweden. The sudden temperature spikes forced multiple retailers to clear display shelves, dispose of perishable goods, and alter daily store operations. Several affected companies confirmed that their cooling systems had been breached.

European Union Food and Agriculture Commissioner Christophe Hansen described the repeated cyber-attacks as deeply concerning. Hansen stated that the intrusions constituted "a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it." The events follow a broad cyber-attack in France last month, where hackers took control of cooling units in as many as 700 supermarkets, driving internal temperatures up to 50C, triggering localized electrical fires, and destroying fresh and frozen food stock worth tens of millions of euros.

While individual store managers responded to system failures during the early hours of Monday morning, national cybersecurity bodies began monitoring events and coordinating across borders. Government cybersecurity agencies in Sweden and Belgium confirmed they were actively tracking incidents within their borders. In the United Kingdom, the National Cyber Security Centre stated that it was liaising with international partners and private industry to evaluate the situation, while noting that no domestic supermarket disruptions had been reported.

Impact Across Belgian and Dutch Commercial Markets

In Belgium and Luxembourg, Dutch retail conglomerate Ahold Delhaize confirmed that refrigeration equipment in dozens of its supermarkets had been compromised overnight. According to reporting by BBC News World, approximately 40 Delhaize locations across Belgium and Luxembourg suffered cooling system failures. At a Delhaize store located north-east of Brussels, reporters from The Guardian observed empty refrigerators and freezers alongside customer notices reading: "Due to cyberattacks, there will be no products on the refrigerated or freezer shelves. We offer our sincere apologies." Sarah De Meester, a spokesperson for Ahold Delhaize, stated that while the availability of fresh and frozen items was "temporarily somewhat limited" inside affected outlets, corporate distribution centers continued to function normally without delivery interruptions.

In the Flemish municipality of Hoeilaart, north of Brussels, a single Delhaize store manager told local news site Het Laatste Nieuws that the branch lost €100,000 (£83,500) worth of stock. The manager specified that the calculation did not account for additional financial losses expected from mandatory store closures during cleanup and repairs. Belgian newspaper Le Soir reported that dozens of shops and markets experienced disruption, including Proxy Delhaize mini-markets and Shop & Go convenience locations attached to Q8 service stations.

Refrigeration systems provider Sabcobel, which manufactures and operates cooling infrastructure for Delhaize stores, confirmed that technicians detected automated overrides shortly after midnight. Stephan Moelans, chief executive of Sabcobel, told Le Soir that the company mobilized technical crews at 1:00 a.m. who "spent all night and morning disconnecting the affected installations." Speaking to the Belga news agency, Moelans confirmed that the disruption was a cyber-attack in which intruders remotely forced the evaporator units of the refrigeration systems into defrost mode, rapidly raising internal compartment temperatures.

The disruptions affected multiple other commercial retail operators in Belgium. French supermarket group Carrefour stated that roughly 15 of its 700 Belgian branches experienced refrigeration issues. Carrefour spokesperson Mich Vergauwen stated, "It’s a cyber-attack, there is no other reason," adding that emergency mitigation steps allowed all affected Carrefour outlets to remain open to shoppers. Retail group Colruyt told Reuters that five of its franchised Spar stores were hit. French chain Intermarché registered fridge failures across 15 Belgian locations. Swedish home furnishings retailer Ikea reported that freezers in its store in Mons, a city in western Belgium, suffered a sudden heat spike due to a cyber-attack. An Ikea spokesperson told Agence France-Presse that food products, including its signature Swedish meatballs, were cleared from units as a precautionary step, leading to expected food waste, while a spokesperson quoted by Reuters noted that "we cannot rule out that additional locations may be affected."

Across the border in the Netherlands, public radio broadcaster NOS reported that refrigeration units at no fewer than 17 businesses—primarily butcher shops and small neighborhood grocery stores—were compromised overnight. A spokesperson for Danish equipment manufacturer Danfoss told NOS that cooling systems belonging to at least 17 Dutch companies were targeted in the attack. The Dutch incidents follow a prior report filed with law enforcement by Ahold Delhaize last month regarding a similar digital intrusion against its infrastructure in the Netherlands.

Targeted Intrusions in Sweden, Finland, Estonia, and Ireland

In Sweden, national grocery operators Coop and ICA confirmed that automated overrides had affected cooling systems in several stores. The head of Sweden’s national cybersecurity centre, John Billow, told the agency that officials were working on incidents around the country after establishing that Sweden possessed "quite a lot of exposed operational technology devices" that needed updating or patching.

Swedish retail group Coop told the daily newspaper Aftonbladet that six of its shops had been compromised, while a corporate spokesperson subsequently told the broadcaster that seven of its 800 stores nationwide were hit but the "situation is currently contained and under control". Competitor ICA confirmed through a spokesperson that the incident affected a "small number of ICA stores operating outside ICA's central network", adding that ICA was supporting the affected stores. An affected ICA branch in Sjöbo, in southern Sweden, announced on social media that its fridges and freezers were hacked overnight and set to 50C, closing before reopening later. Another ICA branch in Stockholm reported that its freezers were broken "due to a 2am cyberattack" and that "everything was destroyed".

In neighboring Finland, Finnish daily Helsingin Sanomat reported that retail conglomerate Kesko launched an internal investigation after detecting system anomalies across several of its K-store locations. In Estonia, cooling equipment supplier Kitman Coldtech reported that intruders gained access to a central control computer managing refrigeration at an Estonian grocery chain on Monday morning. Kitman Coldtech chief executive Jann Mutso told Estonian public broadcaster ERR that attackers raised temperature settings to 50C, but stated that rapid detection prevented extensive stock destruction. Mutso noted, "This is very fresh, it happened this morning," confirming that technicians responded within minutes. Estonian retail chain Selver confirmed that at least one of its supermarkets was affected, while ERR reported additional corporate disruptions across the country.

In Ireland, SuperValu, the nation's third-largest supermarket chain, confirmed that cooling systems across 13 of its 223 store locations were compromised. A spokesperson for parent company Musgrave Group told The Irish Times that the incident specifically targeted a single model of refrigeration unit. Store staff acted to remove all chilled and frozen goods from retail shelves to prevent compromised items from reaching consumers.

Vulnerabilities in Remote Building Controllers and Operational Technology

According to reporting by the broadcaster, most supermarkets across Europe are connected to the internet, allowing maintenance and troubleshooting to be performed remotely. Reports also note that a growing range of devices, including refrigeration systems, can now be monitored and controlled remotely, leading authorities to express concern over potential government-sponsored hybrid attacks following Russia’s 2022 invasion of Ukraine.

Speaking to the Belga news agency, Sabcobel chief executive Stephan Moelans noted that since the October cyber-attack in France, Sabcobel had been working to protect customer infrastructure against remote intrusions. Moelans explained that while most retail clients migrated their networks to secure internet connections following the French breaches, long-term security requires direct physical modifications to the refrigeration hardware rather than reliance on software patches alone.

Cybersecurity analysts reviewing the events pointed to the operational characteristics of the incidents. Tom Hegel of the cybersecurity firm SentinelOne told the agency that while many cyber-attacks involve extortion or are politically motivated, the supermarket incidents lacked financial demands, which he said points to sabotage. Hegel noted that "retail is an easy target because retail chains run enormous estates of refrigeration controllers, building management systems, door access panels and point-of-sale gear."

Patrick Lamplmair, an analyst at cybersecurity firm Tributech, observed that attackers encounter low technical barriers when targeting exposed industrial hardware. Lamplmair told reporters that automated attacks against commercial infrastructure will continue "until it stops working" because the execution method is "cheap and the damage is immediate." He emphasized that numerous refrigeration controllers contained known, unpatched vulnerabilities, adding that "thousands of these controllers were still reachable from the internet after the French attack" and noting that "a few commands to a temperature controller can destroy stock overnight and close stores."

Technical Parallels to the October Campaign in France

The systemic disruptions recorded across Northern Europe match the operational signatures of the major cyber-attack carried out across France in October. During that campaign, perpetrators breached software controllers connected to as many as 700 individual supermarkets, including outlets operated by retail groups Intermarché, Coopérative U, Carrefour, Leclerc, and Monoprix. Attackers altered baseline operational controls, driving temperatures from sub-zero storage environments as low as -27C up to temperatures exceeding 50C.

The thermal stress caused by forced defrost cycles during the French breach produced secondary hazards, including localized electrical fires within store machinery rooms and widespread food spoilage. Supermarkets across France were forced to discard high volumes of fresh meat, dairy products, and frozen inventory. Financial assessments compiled by French trade groups indicated total food losses in the tens of millions of euros, with individual store owners reporting inventory damage between tens of thousands of euros and more than €130,000 (£109,000).

Investigations in France determined that the hackers pirated temperature controllers manufactured primarily by Danish engineering group Danfoss, alongside units produced by two additional control hardware companies identified by French national cybersecurity agency Ansii. Danfoss subsequently stated that it had identified specific security flaws in its system software during the preceding year and had "long recommended" that commercial customers install security updates. Following the October incident, French Prime Minister Sébastien Lecornu instructed Ansii to launch a comprehensive technical investigation, while the Paris prosecutor's office opened a formal criminal inquiry. French judicial authorities and cybersecurity investigators have not publicly identified the perpetrators, and no criminal syndicate or political entity has claimed responsibility for the French attacks.

International Cyber Investigations and Potential Military Connections

The recurrence of broad attacks against commercial food infrastructure has raised concerns among European national security agencies regarding state-sponsored hybrid warfare tactics. Intelligence authorities have highlighted increased risks to civilian infrastructure following Russia's 2022 invasion of Ukraine, citing energy grids, transport hubs, and food supply chains as primary targets for low-cost digital disruption. Authorities fear that accessible internet-connected physical systems could be targeted to generate widespread economic disruption and undermine public confidence.

Cross-border investigative efforts have expanded beyond European jurisdictions. Federal authorities in the United States are currently examining unexplained refrigeration system failures that occurred across a number of domestic American military bases in August. US investigators are collaborating directly with French law enforcement and cybersecurity officials to determine whether the military facility disruptions share software code, command protocols, or network infrastructure with the European supermarket breaches.

As of Monday evening, no group, corporate entity, or government agency has asserted responsibility for the attacks across Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands, or Sweden. Law enforcement agencies and incident response teams across the seven affected countries continue to extract server logs and examine compromised control hardware to determine the origin of the network commands.

This report was prepared with AI assistance and checked against the sources it relied on. Read our editorial standards and methodology.