Dozens of supermarket stores across seven European countries have been forced to discard large quantities of chilled and frozen food after suspected cyber-attacks remotely interfered with their refrigeration systems, sending temperatures soaring and disrupting operations.
The incidents, reported on Monday, affected retailers in Belgium, Luxembourg, Sweden, Ireland, Estonia, Finland and the Netherlands. Refrigeration units in some stores reportedly reached temperatures of up to 50°C, rendering food stocks unsafe for consumption. The attacks have renewed concerns about the cybersecurity of internet-connected systems that underpin critical retail operations and food supply chains.
Among the affected retailers were Ahold Delhaize, Carrefour, Colruyt, ICA, Coop and SuperValu. Ahold Delhaize confirmed that an IT incident had affected refrigeration equipment at dozens of its Delhaize stores in Belgium and Luxembourg. Carrefour reported problems at approximately 15 of its 700 Belgian outlets, while Colruyt confirmed that five stores had been affected.
In Sweden, supermarket chains ICA and Coop also reported disruptions. One ICA store in Sjöbo said its refrigeration units had been hacked and their temperatures raised to 50°C. Coop confirmed that cooling systems at seven of its approximately 800 stores had been compromised, with disruptions ranging from partial failures to complete shutdowns.
In Ireland, refrigeration systems at 13 SuperValu stores were affected. Musgrave, the retailer’s owner, said its monitoring systems detected irregularities, prompting immediate action to remove chilled and frozen products from sale as a precaution. An Ikea store in Belgium was also reportedly affected.
The financial impact has been significant for individual outlets. A Belgian butcher’s chain estimated that it lost approximately €15,000 in stock at one store, while another Delhaize location reportedly discarded products worth about €100,000. Employees at affected outlets spent hours removing spoiled goods, with large quantities transported away in trolleys and skips.
Attackers exploited internet-connected refrigeration systems
Initial technical assessments indicate that attackers gained remote access to internet-connected refrigeration controllers and manipulated their operating settings, forcing cooling units into continuous or prolonged defrost mode. The process caused temperatures to rise rapidly, compromising food stored in refrigerators and freezers.
Belgian refrigeration company Sabcobel, which works with Delhaize systems, described the incidents as a cyber-attack involving the unauthorised switching of evaporators into defrost mode.
The method resembles an attack in France last month that affected hundreds of supermarket stores, triggered fires in some locations and resulted in food losses estimated at tens of millions of euros.
Refrigeration controllers manufactured by companies including Danfoss were among the systems previously identified as potentially vulnerable when connected to the internet without adequate security protections.
The repeated incidents point to a wider exposure in retail infrastructure, where equipment traditionally designed to regulate temperature and energy consumption is increasingly connected to remote monitoring and management networks.
EU raises concerns over food supply chain security
European Union food and agriculture commissioner Christophe Hansen described the latest incidents as deeply concerning, warning that deliberate interference with supermarket infrastructure could undermine confidence in the region’s food supply chain.
Sweden’s national cybersecurity centre said it was investigating the local incidents. However, no group has publicly claimed responsibility, and authorities have not established who carried out the attacks or whether the incidents were coordinated across the affected countries.
The absence of ransomware demands has also complicated assessments of the attackers’ motives. Security analysts have suggested that the incidents could represent a demonstration of cyber capabilities by state-linked actors or an attempt to cause economic and psychological disruption. These possibilities remain speculative, with no confirmed attribution.
Affected retailers have begun restoring operations by disconnecting compromised systems from their networks, replacing spoiled products and bringing refrigeration equipment back online. Most stores reported that other products remained available to customers.
The incidents have placed renewed attention on the security of operational technology, particularly internet-connected industrial control systems that manage essential functions in supermarkets, warehouses and other commercial facilities.
While refrigeration equipment is rarely considered a frontline cybersecurity risk, the attacks demonstrate how remotely accessible systems can become entry points for disrupting physical operations, generating financial losses and threatening the reliability of everyday supply chains.
