Supermarket chains in at least seven European countries have reported disruptions to their refrigeration systems after suspected cyberattacks caused temperatures in some refrigerators and freezers to rise to as high as 50C.
Gatekeepers News reports that the incidents, reported on Monday in Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden, mirror a cyberattack in France last month that caused millions of euros in damage and significant food losses.
Several retailers confirmed they had been hacked, while others reported technical problems affecting refrigeration and freezer systems.
European Union Commissioner for Food and Agriculture, Christophe Hansen, described the repeated incidents as deeply concerning, warning that they could threaten food security and consumer confidence.
He called the attacks “a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it”.
The latest incidents have heightened concerns over the vulnerability of remotely controlled refrigeration systems, particularly amid fears of state-sponsored hybrid attacks following Russia’s 2022 invasion of Ukraine.
Supermarkets in Sweden, Belgium affected
In Sweden, supermarket chains Coop and ICA reported disruptions to refrigeration systems in some of their outlets.
Coop told the daily Aftonbladet that six of its shops had been affected, while ICA said it was “aware that a limited number of stores were affected by an incident overnight which impacted their refrigeration and freezer systems”.
An ICA outlet in Sjöbo, southern Sweden, said its refrigerators and freezers had been hacked, with their temperatures set to 50C.
Another store in Stockholm reported that its freezers had been damaged “due to a 2am cyberattack”, adding that “everything was destroyed”.
Sweden’s National Cybersecurity Centre chief, John Billow, said the agency was investigating incidents across the country.
He told Reuters that authorities had identified “quite a lot of exposed operational technology devices” that required updates or security patches.
In Belgium and Luxembourg, retailer Ahold Delhaize said refrigeration systems in dozens of its supermarkets had been affected.
The company, which reported a similar incident to Dutch police last month, did not immediately specify the cause of the latest disruption.
At a supermarket northeast of Brussels, reporters observed empty refrigerators and freezers alongside a notice stating: “Due to cyberattacks, there will be no products on the refrigerated or freezer shelves. We offer our sincere apologies.”
Ahold Delhaize spokesperson Sarah De Meester said the availability of fresh and frozen products had been “temporarily somewhat limited” in affected stores.
She added that distribution centres remained operational and deliveries had not been disrupted.
Belgian newspaper Le Soir reported that dozens of shops and supermarkets had been affected, including five Spar outlets, Shop & Go convenience stores attached to Q8 service stations and some Proxy Delhaize mini-markets.
Stephan Moelans, chief executive of Sabcobel, which operates Delhaize’s refrigeration systems, said technicians had been mobilised overnight.
“We started mobilising technicians at 1am,” he told the newspaper. “We spent all night and morning disconnecting the affected installations.”
Moelans confirmed to the Belga news agency that the incident was a cyberattack, adding that the refrigeration units’ evaporators had been switched to defrost mode.
Other Belgian retailers also reported disruptions. Colruyt said five of its stores were affected, while Intermarché reported problems in 15 outlets.
Carrefour Belgium said refrigeration systems in about 15 of its 700 stores had experienced disruptions.
Ikea, known for its in-store Swedish meatballs, said it had removed some food products from refrigeration units as a precaution and expected some food waste.
Ireland, Finland and Estonia report incidents
In Ireland, SuperValu, the country’s third-largest supermarket chain, said refrigeration systems in 13 of its 223 stores had been affected by a cyber incident.
The disruption was limited to a specific model of refrigeration system, and chilled and frozen products had been removed from sale.
In Finland, the Helsingin Sanomat newspaper reported that stores operated by supermarket chain Kesko were investigating similar problems.
Dutch public broadcaster NOS reported that the refrigeration systems of at least 17 shops, mainly smaller local outlets, had been affected in the Netherlands.
In Estonia, refrigeration supply company Kitman Coldtech told broadcaster ERR that attackers had accessed a computer controlling a supermarket’s refrigeration system and increased the temperature to 50C.
“This is very fresh, it happened this morning,” the company’s chief executive, Jann Mutso, said.
He added that the incident was addressed within minutes and had caused no significant damage.
The Selver supermarket chain confirmed that one of its outlets had been affected.
Experts warn of vulnerable refrigeration systems
Cybersecurity experts said the attacks appeared to be aimed at sabotage rather than financial extortion, given the absence of ransom demands.
Tom Hegel of cybersecurity firm SentinelOne said many cyberattacks were financially or politically motivated and could involve state-level actors.
However, he said the supermarket incidents suggested a deliberate effort to cause damage.
“Retail is an easy target because retail chains run enormous estates of refrigeration controllers, building management systems, door access panels and point-of-sale gear,” Hegel told Reuters.
Patrick Lamplmair of cybersecurity firm Tributech said attackers were likely to continue exploiting the systems as long as the method remained effective.
Cybercriminals would keep going “until it stops working”, he said, describing the approach as “cheap and the damage is immediate”.
Lamplmair warned that many refrigeration systems contained known vulnerabilities that had yet to be fixed.
“Thousands of these controllers were still reachable from the internet after the French attack,” he added.
“A few commands to a temperature controller can destroy stock overnight and close stores.”
French attack caused millions of euros in losses
The latest incidents follow a major cyberattack in France last month, when hackers seized control of refrigeration units in as many as 700 supermarkets.
The attackers remotely overrode settings on thousands of freezers, refrigerators and chiller cabinets, raising temperatures from as low as -27C to above 50C.
The affected retailers included Intermarché, Coopérative U, Carrefour, Leclerc and Monoprix.
The attack forced supermarkets to discard large quantities of fresh meat, dairy products and frozen food, with total losses estimated at tens of millions of euros.
Individual stores reportedly suffered losses ranging from tens of thousands of euros to more than €130,000 (£109,000).
The compromised controllers were mostly supplied by Danish company Danfoss, which said after the incident that it had identified some security flaws the previous year and had “long recommended” that customers install updates.
France’s Paris prosecutor’s office has opened a formal investigation into the attack, while Prime Minister Sébastien Lecornu directed the country’s national cybersecurity agency, ANSSI, to investigate.
The agency later reported that supermarkets using controllers supplied by two other companies had also been targeted.
Authorities have not identified those responsible for the attacks, and no group has claimed responsibility.
