Cyberattack on Fridges Disrupts Supermarkets Across Europe

Supermarket chains across Belgium, Estonia, Finland, Luxembourg, and Sweden discovered their refrigerators and freezers had suffered overnight temperature spikes on Monday in a suspected widespread cyberattack. What remains least expected by shoppers browsing chilled aisles is that older refrigeration controllers linked to external networks — particularly models produced by Danish manufacturer Danfoss — can be remotely manipulated to switch evaporators into defrost mode, pushing internal cabinet temperatures as high as 50 degrees Celsius or 122 degrees Fahrenheit.

The core reality driving these incidents is that retail grocery infrastructure has outpaced its own digital defense, leaving millions of operational technology devices exposed to remote interference. While industry executives and refrigeration providers scramble to isolate affected stores, the vulnerability of connected commercial real estate has transformed the quiet hum of supermarket compressor rooms into an economic battleground. The central counter-view from major retailers such as Sweden's ICA and Coop initially resisted labeling the overnight failures as malicious hacks, pointing instead to equipment malfunctions before digital forensics confirmed the remote tampering. Yet the physical evidence of widespread spoilage across five European nations points directly to an orchestrated exploitation of legacy remote-access systems.

Who is affected and how severe are the losses?

The operational disruptions have forced major grocers and independent franchise owners to discard massive quantities of fresh meat, dairy products, and frozen goods. The impacted organizations and specific operational footprints include:

• Ahold Delhaize and Colruyt, hitting dozens of stores in Belgium and Luxembourg.
• Swedish grocers ICA and Coop, affecting a limited number of branches in Stockholm and across the country.
• Carrefour, reporting disruptions in 15 out of its 700 stores in Belgium.
• Ikea, confirming that one of its Belgian stores in Mons suffered refrigeration failures.
• Musgrave food wholesaler in Ireland, impacting refrigeration systems across 13 SuperValu stores.
• Kitman Coldtech clients in Estonia, along with smaller grocery stores operated by the Kesko group in Finland and 17 smaller shops in the Netherlands managed by Danfoss technology.

Independent merchants have also absorbed severe blows. Luc De Laet, founder and owner of Belgian butchery chain De Laet & Van Haver, rushed to his store in Hove south of Antwerp at 3.30am after an employee alerted him to a problem, only to find fridges turned up as high as 18 degrees Celsius and approximately 15,000 euros worth of meat ruined. Such localized losses compound into millions of euros in damaged stock across the continent, directly mirroring an October attack in France that targeted up to 700 supermarkets and caused hundreds of thousands of euros in damage across individual regions like Alsace.

Why are these cooling systems so vulnerable now?

The rapid digitization of grocery supply chains has bridged the gap between mechanical hardware and internet-connected management tools, creating an expanding attack surface for malicious actors. Refrigeration units, heating systems, security cameras, and alarm networks that once operated on closed, local loops are now routinely monitored and controlled remotely to streamline maintenance and track food safety compliance. However, many of these operational technology devices rely on older software controllers that no longer receive security updates or patches.

I've been awake since 2am. We've been working all night and morning to disconnect the affected units from the network.

Stephan Moelans, CEO of Sabcobel, via Reuters

Stephan Moelans, CEO of Belgian refrigeration firm Sabcobel which operates Ahold Delhaize's systems, explained that units were specifically targeted by switching their evaporators to defrost mode. Carlos Cancino, a spokesman for Swedish retailer Coop, noted that affected stores were connected to an older 4G mobile network rather than updated 5G infrastructure, heightening their exposure. John Billow, head of Sweden's national cybersecurity centre, acknowledged that authorities had identified numerous exposed operational technology devices across the country in recent weeks, warning of the absolute necessity to update or patch them before attackers could exploit them.

What are authorities and industry leaders doing to respond?

European officials have elevated the crisis from a routine IT glitch to a critical threat against the bloc's stability. Christophe Hansen, the EU's food commissioner, stated that the incidents were a deliberate attempt to undermine consumer confidence in the EU's food supply, describing the weaponization of food as an emerging reality while confirming that no immediate risk to broader food security exists at this stage. Investigative momentum is growing internationally as well, with U.S. officials reaching out to French counterparts to share intelligence following a parallel incident in late August where six on-base commissaries, including one at Fort Huachuca in Arizona, suffered mysterious overnight freezer malfunctions that forced officials to discard all frozen food.

Security specialists across Europe are actively auditing older Danfoss controllers and disconnecting vulnerable units from external networks. Yet, as Roni Kokkola, an information security specialist at Finland's National Cyber Security Centre, noted, the spread of these attacks beyond France was entirely anticipated given the vast pool of unpatched legacy hardware currently deployed in retail stores. Retailers are racing to manually inspect settings, verify local alarms, and transition remote monitoring tools behind secure virtual private networks.

What happens when the next cold-storage wave hits?

The overarching danger for the European retail sector is that unlike a sudden mechanical breakdown, a remote cyberattack operates silently until food spoilage is complete. The threshold between safe cold storage and wholesale destruction now relies entirely on how quickly grocers can inventory their digital exposure and sever unauthorized remote access points. With no individual or group claiming responsibility for either the October assaults in France or the November wave across five European countries, investigators face an anonymous adversary capable of manipulating industrial hardware from afar. The critical question remains whether European supermarket chains can retrofit thousands of legacy refrigeration controllers with modern cybersecurity architecture before another wave of remote hacks empties the continent's frozen-food aisles again.