A fresh wave of cyberattacks has struck refrigeration systems at supermarkets across Europe, remotely pushing freezer temperatures to roughly 50 degrees Celsius and forcing retailers to discard large volumes of chilled and frozen food. The incident, which unfolded overnight into Monday, marks the second such campaign in barely a month, following an October attack that disrupted hundreds of French supermarkets and reportedly caused fires.
- Widespread impact: Stores in Belgium, Sweden, Luxembourg and the Netherlands reported tampered cooling systems, with dozens of outlets affected.
- Low-cost sabotage: Attackers did not steal data or deploy ransomware; they simply activated defrost modes and raised temperatures.
- Legacy hardware blamed: Affected controllers were connected to unprotected networks and relied on default passwords.
How the attack unfolded across Europe
According to reporting from Reuters and local outlets, the attackers manipulated refrigeration and freezer systems at dozens of stores, hitting major grocery groups including Ahold Delhaize and Colruyt in Belgium and Luxembourg, as well as Swedish chains ICA and Coop. IKEA confirmed that at least one store in Belgium was affected. In Ireland, wholesaler Musgrave said systems at 13 of its SuperValu stores were impacted, forcing the removal of some chilled and frozen products from sale.
The scale varied by country. Carrefour reported that 15 of its 700 Belgian stores were hit, while Delhaize confirmed around 40 of its locations suffered a “computer incident.” Intermarché said 15 stores experienced technical problems, and Colruyt reported five affected shops. In Sweden, an ICA franchise sales manager described the scene bluntly: freezers had reached 50 degrees Celsius, and everything inside was destroyed. The attack occurred around 2 a.m. local time but was only noticed hours later.
“There has been a cyberattack and all our freezers reached 50 degrees (Celsius),” said Engla Ingwall, sales manager at an ICA franchise store in Stockholm.
In the Netherlands, refrigeration equipment supplier Danfoss reported that at least 17 businesses, mainly butcher shops and small neighborhood stores, suffered remote temperature manipulation. One frozen goods warehouse saw temperatures rise from the usual minus 20 degrees Celsius to minus 10 degrees. Danfoss said the affected equipment was connected to unprotected networks and used default passwords, allowing attackers to access and alter operations.
Who is behind it, and why retail is an easy target
No group has claimed responsibility, and investigators have not established whether the campaign is linked to the earlier French incident. Belgium’s Center for Cybersecurity said the perpetrators may never be identified. The agency’s spokesperson, Katrien Eggers, expressed concern about the growing frequency of such incidents, partly due to AI. “All IT systems are potentially vulnerable, and AI can now be used to successfully exploit these weaknesses, especially by sophisticated actors,” she said.
Security researchers note that the absence of financial demands points toward sabotage rather than extortion. Tom Hegel, a researcher at SentinelOne, explained that retail chains run enormous estates of refrigeration controllers, building management systems, door access panels and point-of-sale gear, making them attractive targets. “An attacker who logs into an exposed control panel leaves almost nothing behind,” he said. “A teenager and an intelligence service would look much the same from the defender’s side.”
The European Commission framed the attacks as a deliberate strike against the food supply chain. “They are a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it, a warning that we must take seriously,” said EU agriculture commissioner Christophe Hansen.
Why the fix is slow, expensive and physical
The core problem is that many of these refrigeration units are industrial machines designed to last years, installed long before internet connectivity became standard. Patching software is not enough. According to reporting, the CEO of Sabcobel, a Belgian installer managing hundreds of such systems, said many freezers require physical modifications. Delhaize opted for the most drastic measure: cutting internet access to the equipment entirely.
Danfoss said it had been working with customers to implement fixes and had warned Dutch clients in mid-October about the risks, recommending they disconnect systems from the internet. The company’s temperature control technology was also implicated in the French attack, underscoring how a single vendor’s installed base can become a continent-wide attack surface.
The broader lesson is uncomfortable for any business running connected industrial equipment. These attacks cost almost nothing to execute and cause immediate, tangible damage without touching a single physical component. Two waves in a matter of weeks suggest a pattern rather than a coincidence. Defense, however, remains slow and costly because it requires touching aging hardware store by store. The most ignored rule of operational technology security still applies: if a device does not need to be on the internet, it should not be.