The European Commission will examine supermarket cyber defences across the continent after hackers tampered with refrigeration controls at major food retailers in six member states, forcing cooling units into defrost cycles and spoiling stock.
Key points
- The European Commission will convene its Security College to examine retailer incident response plans and backup arrangements.
- Co-ordinated tampering on 2 November pushed fridges to 50 degrees Celsius at stores in Sweden, Belgium, Luxembourg, Ireland, Estonia and the Netherlands.
- Retailers including Ahold Delhaize, Colruyt, Carrefour, ICA, Coop, SuperValu and IKEA suffered cooling failures.
- Technicians had to physically disconnect vulnerable controllers because older internet-connected refrigeration units lack security patches.
Commission initiates grocery infrastructure review
European Union officials confirmed on Tuesday that the European Commission will formally evaluate supermarket cyber defences to assess how retailers protect essential food distribution from digital disruption. The decision follows a wave of intrusions on Monday that knocked out cooling equipment across supermarkets in Belgium, Luxembourg, Estonia, the Netherlands, Ireland and Sweden.
The incidents will be referred directly to the Commission’s Security College, according to agriculture and food commissioner Christophe Hansen, who spoke to Politico about the intervention. Commission president Ursula von der Leyen established the Security College in March 2025 to bring all commissioners together to tackle emerging risks to European security. Reviewing retail disruptions within that body signals that officials view tampering with food logistics as a potential hybrid threat designed to weaken public confidence.
Hansen said Europe’s overall food security remained stable, but warned that repeated tampering posed acute risks to supply chain operations. While cabinet chiefs agreed on Friday that the meeting should take place promptly, officials have not yet published a formal date for the session. The review will focus on the speed at which retail chains detect unauthorised configuration changes and the strength of their manual fallback plans.
Co-ordinated attacks across six nations
The latest disruption follows earlier reports when a supermarket refrigeration cyberattack struck retail premises across multiple countries. Monday’s wave affected stores operated by Ahold Delhaize, Colruyt, Carrefour, ICA, Coop and SuperValu, alongside an IKEA outlet in Belgium. In several locations, cooling systems reached temperatures as high as 50 degrees Celsius after attackers manipulated heating elements intended solely for maintenance defrosting.
In Belgium, industrial refrigeration contractor Sabcobel discovered that intruders had altered setpoints across cooling networks that service Delhaize and other retail brands. Stephan Moelans, chief executive at Sabcobel, said technical teams deployed at 1:00 am to physically sever network connections to infected units. Moelans explained that shielding older hardware against repeat incidents will require retailers to replace physical components and commit fresh capital investment.
The events echo a large-scale intrusion in France on 12 October, which compromised between 500 and 700 supermarkets. That earlier campaign altered settings on commercial control units built by Danish manufacturer Danfoss, ruining chilled goods and sparking isolated electrical fires. Intermarch)’s chief executive estimated that stock losses and equipment damage from the French attack could run into millions of euros. Similar incidents were documented when a supermarket refrigeration cyberattack spreads to UK facilities during earlier cross-border testing.
Why industrial refrigeration controllers are vulnerable
Commercial grocery chillers, bakery ovens and warehouse climate networks increasingly rely on remote telemetry so store managers and third-party contractors can adjust temperatures, track power consumption and log regulatory compliance data without visiting the plant room. However, connecting operational technology to cloud management dashboards exposes legacy hardware to automated internet scanning.
Security specialists point out that many store installations rely on field controllers deployed years ago. Pavlina Pavlova, founder of cybersecurity non-profit Critical Cyber, told Euronews Next that such devices continue to operate because they sit deep within facility maintenance budgets: “They run on old systems that are deprioritised or impossible to patch; many of the controllers hit in France, for example, were older models that no longer receive security updates, despite flaws known since 2025.”
Once an attacker gains administrative access to a cooling subnet through exposed remote-access ports, stolen vendor credentials or unauthenticated application interfaces, they can modify system settings at will. By activating continuous defrost cycles, intruders turn chillers into heaters. In typical food safety regimes, stock exposed to temperatures above critical thresholds must be condemned and disposed of, magnifying financial losses beyond the cost of repairing the digital systems themselves.
Attribution, intent and artificial intelligence tools
Neither European law enforcement agencies nor private incident responders have formally attributed the October or November intrusions to a specific group. No ransomware notes were deposited, and no extortion demands have been received by the affected supermarket chains, ruling out straightforward financial extortion.
French investigators suspect foreign state-backed actors carried out the 12 October attacks, though Paris has withheld definitive attribution. Marta Rybczynska, founder of cybersecurity consultancy Ygreky, told Euronews Next that the absence of financial demands pointed toward disruptive motives: “Investigators are silent about current results of the investigation in France, but by elimination it is likely that we have some state-supported group behind this.”
Rybczynska observed that grocery cooling networks made attractive targets because instructions for manipulating industrial temperature controllers circulate openly across online forums. She noted that retail operators had long failed to consider their chillers as critical infrastructure, leaving basic administrative interfaces open to external networks even after the French disruptions became public knowledge.
Threat analysts also warn that offensive artificial intelligence tools are accelerating the pace of such attacks. Machine learning engines allow hostile actors to scan large blocks of internet protocol addresses, identify specific controller models, and assemble exploit scripts in minutes. While human defenders struggle to schedule downtime to install firmware fixes, automated scanning scripts can discover thousands of unprotected store networks simultaneously.
What happens next
The Commission’s forthcoming Security College session will examine whether existing critical infrastructure rules, including the revised Network and Information Security Directive, should explicitly impose stricter operational technology standards on retail grocery logistics. Officials previously met retailers impacted by the French attacks in late October to gather technical data on the Danfoss breaches.
Retailers in affected countries have started isolating climate and refrigeration management networks from general corporate internet lines. Engineering teams at targeted chains are reviewing internal virtual private networks, resetting vendor access credentials, and adding manual circuit overrides to ensure equipment cannot be forced into destructive heating cycles without on-site confirmation from store staff.
