Supermarket chains in seven European countries said on Monday that refrigerators and freezers in some of their stores climbed overnight to as high as 50 °C (122 °F). It is the second wave in a month, and the first to hit the continent at once.

Retailers in Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands and Sweden reported problems with their refrigeration systems, and several confirmed they had been hacked. The EU food and agriculture commissioner, Christophe Hansen, called the repeated attacks deeply concerning and "a deliberate attempt to disrupt our food supply chain and undermine consumers' confidence in it."

What happened in the aisles

In Sweden, Coop said six of its shops had been affected. ICA said a "limited number" of stores had suffered an overnight incident affecting refrigeration and freezer systems. One ICA shop in Sjöbo posted that its fridges and freezers had been hacked and the temperature set to 50 °C; another in Stockholm said its freezers were broken "due to a 2am cyberattack" and that "everything was destroyed".

The Dutch retailer Ahold Delhaize said fridges and freezers in dozens of its supermarkets in Belgium and Luxembourg had been hit. Reporters near Brussels found empty shelves and a sign reading: "Due to cyberattacks, there will be no products on the refrigerated or freezer shelves. We offer our sincere apologies." Belgium's Le Soir reported dozens of shops affected, including five Spar outlets, Shop & Go convenience stores at Q8 service stations and some smaller Proxy Delhaize mini-markets. Stephan Moelans, chief executive of Sabcobel, which operates Delhaize's refrigeration systems, told the paper: "We started mobilising technicians at 1am. We spent all night and morning disconnecting the affected installations." The units' evaporators, he said, had been switched to defrost mode.

Colruyt reported problems in five shops, Intermarché in 15, and Carrefour Belgium in about 15 of its 700. "It's a cyberattack, there is no other reason," said Carrefour spokesperson Mich Vergauwen. Ikea Belgium said an attack had caused freezer temperatures in its Mons store to rise suddenly and that some food had been pulled from chillers as a precaution.

Ireland's third-largest chain, SuperValu, said a cyber-incident had affected refrigeration systems of one specific model in 13 of its 223 shops, and that chilled and frozen products had been removed from sale. In Estonia, refrigeration supplier Kitman Coldtech told the ERR broadcaster that attackers had reached a computer controlling a store's cooling system and turned the temperature to 50 °C; chief executive Jann Mutso said the response took minutes and damage was not significant. The Selver chain confirmed one affected outlet. In Finland, Helsingin Sanomat reported that shops in the Kesko chain were investigating similar problems, while Dutch public radio NOS said systems at at least 17 mostly small local shops had been affected.

The French rehearsal

Monday's wave follows an attack in France last month in which hackers seized control of cooling units in as many as 700 supermarkets, pushing temperatures from as low as −27 °C to well over 50 °C. There were fires and food losses estimated in the tens of millions of euros; individual stores reported losses from tens of thousands of euros to more than €130,000. Chains including Intermarché, Coopérative U, Carrefour, Leclerc and Monoprix were hit, and most of the controllers involved came from the Danish supplier Danfoss, which said it had identified some security flaws the previous year and had "long recommended" customers install updates. The Paris prosecutor's office opened a formal investigation, and Prime Minister Sébastien Lecornu instructed France's cybersecurity agency, Ansii, to look into it; Ansii later reported that controllers from two other companies had also been targeted.

Why it keeps happening

What is striking this time is the absence of extortion. "Many cyberattacks involve extortion or are politically motivated and potentially carried out by state-level actors," Tom Hegel of the security firm SentinelOne told Reuters. With no financial demands attached, he said, the supermarket attacks point to sabotage. "Retail is an easy target because retail chains run enormous estates of refrigeration controllers, building management systems, door access panels and point-of-sale gear." Patrick Lamplmair of the firm Tributech said attackers would keep going "until it stops working", because the method is cheap and the damage immediate: "Thousands of these controllers were still reachable from the internet after the French attack. A few commands to a temperature controller can destroy stock overnight and close stores."

Sweden's national cybersecurity centre confirmed it was working on incidents around the country, and its head, John Billow, said Sweden had established it had "quite a lot of exposed operational technology devices" that needed updating or patching. No one has claimed responsibility, and there is no public attribution for either wave.

For operators, the lesson is unglamorous. Refrigeration is remote-maintenance equipment: it sits on building networks, often behind vendor access, and was treated for years like white goods rather than critical infrastructure. Keeping controllers off the public internet, putting them on their own network segment, routing vendor access through a jump host and shipping firmware updates removes the target. Failing that, a retailer's plan for a 2 a.m. call is to mobilise technicians and disconnect the plant — which is what happened on Monday, and what will happen again.

Sources