European Supermarket Freezers Hit by Second Wave of Suspected Cyberattacks
A suspected cyberattack struck supermarkets across six European nations, forcing cooling units into defrost mode and ruining perishable goods.
- Headline: European Supermarket Freezers Hit by Second Wave of Suspected Cyberattacks
- Dispatch Summary: A suspected cyberattack struck supermarkets across six European nations, forcing cooling units into defrost mode and ruining perishable goods.
- Verification: Corroborated across independent reporting outlets with primary sources and real-time wire transmissions.
Shoppers across Europe walked into grocery stores on Monday to find dairy, meat, and frozen goods sitting in warmth after hackers remotely forced supermarket cooling units into defrost mode.
The suspected cyberattack struck on Monday, marking the second major wave of freezer sabotage to hit the continent in weeks following an October incident in France.We can’t adjust the temperatures, we can’t change them. Heat is blowing into the freezers. Everything is ruined.
Rickard Nilsson, a supermarket manager in southern Sweden, via The Record
The disruption hit retail outlets across six European nations.
- Belgium: More than 50 stores affected, including locations run by Ahold Delhaize, Carrefour, and Colruyt Group subsidiary Spar, alongside roughly 40 Delhaize supermarkets across Belgium and Luxembourg.
- Sweden: ICA and Coop shops saw temperatures rise as high as 55C.
- Ireland: Thirteen SuperValu stores owned by Musgrave reported refrigeration failures.
- Estonia: Local grocery stores and older Danfoss systems experienced unauthorized remote access.
- Luxembourg and the Netherlands: Dozens of Ahold Delhaize supermarkets and other grocery chains reported compromised cooling units.
How the Hackers Targeted Legacy Equipment
Investigators and industry specialists point to internet-connected operational technology devices that lack modern security patches or adequate firewall protection. In Estonia, contractors reported that attackers accessed older Danfoss systems, while Dutch broadcaster NOS reported that Copeland equipment was targeted in Belgium. Following the previous French attack, both equipment suppliers noted that the affected devices were mainly discontinued products that no longer receive security updates.
The operational mechanics of Monday's intrusion closely mirror the October campaign in France, where hackers compromised remote controllers for refrigeration systems at up to 700 supermarkets. In that month's incident, tracked by France’s cybersecurity agency ANSSI and the Paris prosecutor’s office, bad actors overrode settings on thousands of units, driving temperatures from as low as -27C to more than 50C. Individual French stores suffered losses ranging from tens of thousands of euros to more than €130,000, with two supermarkets in Alsace reporting combined losses of €270,000.
Stephan Moelans, chief executive of Belgian refrigeration company Sabcobel, mobilized technicians starting at 1 a.m. on Monday. He told Belga that his business handled around 20 affected units out of the hundreds it manages across Belgium, noting that the compromised systems required physical modifications rather than simple software updates.
Who is Responsible and What Lies Ahead
No law enforcement agency, government body, or hacker collective has claimed responsibility for the Monday incident or the French meltdown last month, leaving it unknown whether the same perpetrators carried out both campaigns. John Billow, head of Sweden’s national cybersecurity centre, warned that many operational technology devices remain exposed and urgently require patching or updating.
The structural vulnerability of these supply chains highlights a looming regulatory gap. Although the European Union’s Cyber Resilience Act will impose stricter requirements starting in December 2027—obligating manufacturers to provide support periods matching a product's expected lifetime—no current laws compel manufacturers to fix legacy products targeted by such intrusions. In a previous October newsletter, Danfoss noted that enforcing a hard end-of-service policy for legacy products was necessary to avoid new legal maintenance obligations, pointing to earlier attacks involving its controllers on Russian supermarkets and 40 stores in Israel.
For now, retailers are left tallying millions of euros in spoiled food while security agencies investigate.
Musgrave stated to Irish media that a specific model of refrigeration was affected without detailing the exact technical failure, while Ahold Delhaize categorized the event as an IT incident affecting dozens of its units in Belgium and Luxembourg.
