Suspected cyber-attack raises supermarket freezer temperatures across Sweden, Belgium and Luxembourg

Supermarket refrigeration systems across several European countries appear to have been tampered with overnight, in what retailers suspect is a second wave of cyber-attacks on food cooling equipment. According to The Guardian, chains in Sweden, Belgium and Luxembourg found that fridge and freezer temperatures had risen overnight, prompting comparisons with an attack disclosed in October that caused millions of euros of food losses in France. The Verge, citing local reports shared by Bloomberg and Reuters, said stores in Estonia were also affected, though the full extent of the incident remains unclear.

What the retailers have reported

Sweden's Coop told the daily Aftonbladet that six of its stores were hit, The Guardian reports, while competitor ICA said a limited number of stores had experienced an overnight incident affecting their refrigeration and freezer systems. One ICA Kvantum store said on Facebook that its fridges and freezers had been hacked and their temperatures remotely raised to 50 degrees Celsius (122 Fahrenheit), according to The Verge. A Coop spokesperson separately told Business Insider, as quoted by The Verge, that unauthorized actors had been able to access and tamper with cooling systems at a small fraction of the chain's stores.

Dutch retail group Ahold Delhaize, which The Guardian notes reported a cybersecurity incident to police in the Netherlands last month, described an "IT incident" that affected fridges and freezers in dozens of its supermarkets in Belgium and Luxembourg. Company spokesperson Sarah De Meester said the group had established that temperatures in the cooling systems had increased and that the incident was being investigated.

Belgium's Le Soir newspaper reported that dozens of stores were affected, including five Spar outlets, multiple Shop & Go convenience stores attached to Q8 service stations, and several smaller Proxy Delhaize minimarkets, according to The Guardian. Stephan Moelans, chief executive of the refrigeration installation firm Sabcobel, told the paper his company began mobilizing technicians at 1am and spent the night and morning disconnecting affected installations from the grid.

Echoes of the October attack in France

The new incidents closely mirror an attack French police described in October, in which hackers seized control of cooling units at up to 700 supermarkets. According to The Guardian, the attackers remotely overrode settings on thousands of fridges, freezers and chiller cabinets, pushing temperatures from as low as -27C to well over 50C. The chains affected included Intermarché, Coopérative U, Carrefour, Leclerc and Monoprix.

Stores were forced to discard large quantities of fresh meat, dairy and frozen products, with individual losses ranging from tens of thousands of euros to more than €130,000, and two stores in Alsace reporting a combined loss of €270,000, The Guardian reports.

Most supermarket cold aisles are connected to the internet so that maintenance can be performed remotely and equipment failures can trigger alerts. In the French case, the hackers took over controllers mostly supplied by the Danish company Danfoss, disabling alarm systems before adjusting thermostats or stretching defrost programmes out over hours. Danfoss said it had identified security flaws last year and had long recommended that customers install updates.

The Paris prosecutor's office has opened a formal investigation, saying the damage included food spoilage and fires, and Prime Minister Sébastien Lecornu instructed the national cybersecurity agency ANSSI to examine the attack. ANSSI later confirmed that supermarkets using controllers from two other companies were also targeted.

Why it matters

The incident underlines how much everyday infrastructure now depends on internet-connected embedded systems that are rarely patched as diligently as conventional IT. A compromised freezer controller does not steal data; it destroys physical goods, and in the French case it was reportedly linked to fires. Danfoss's statement, describing flaws identified a year earlier and updates that were recommended but evidently not installed everywhere, reflects a familiar pattern in industrial and building-control equipment, where devices run for years and responsibility for patching is often unclear. The Verge also notes a string of freezer malfunctions at US military bases suspected to be cyber-attacks, suggesting the technique is spreading beyond European grocery retail. If remote maintenance is the reason these systems are online at all, retailers and equipment vendors may now have to weigh that convenience against the risk of losing entire cold-chain inventories overnight.