A supermarket refrigeration cyberattack hit retail chains across six European countries overnight into Monday, tampering with industrial temperature controls, spoiling hundreds of thousands of euros worth of perishable food, and forcing grocers to take connected chilling infrastructure offline.
Key points
- Retailers in Belgium, Sweden, Ireland, the Netherlands, Luxembourg and Estonia reported overnight heating in commercial fridges and freezers.
- Intruders remotely forced cooling evaporators into continuous defrost modes, driving temperatures up to 50 degrees Celsius.
- Equipment installer Sabcobel warned that software patches are insufficient and physical alterations are required to secure the systems.
- National cybersecurity authorities in Sweden and Belgium are investigating the wave, which mirrors a major French breach in October.
The coordinated disruptions began around midnight between Sunday and Monday, targeting internet-connected refrigeration control systems in food retail locations. Freezers and chillers that normally maintain sub-zero environments were reprogrammed remotely to heat up, rapidly defrosting frozen meats, dairy and prepared meals.
Supermarket operators in Belgium, Sweden, Ireland, the Netherlands, Luxembourg and Estonia confirmed disruptions across several retail brands. The incident follows an earlier supermarket refrigeration cyberattack that hit French supermarkets three weeks ago, prompting concerns over structural vulnerabilities in European food distribution networks.
Defrost overrides cause widespread food loss
The mechanics of the disruption centered on operational control hardware. Attackers accessed refrigeration management software to trigger automated defrost cycles while overriding preset temperature ceilings and duration limits. Instead of a short heating pulse to clear ice buildup, evaporators ran continuously at high output.
Stephan Moelans, chief executive of Belgian refrigeration engineering firm Sabcobel, told news agency Belga that the intrusion relied on the identical mechanism used during the French retail attacks in mid-October. Moelans said Sabcobel engineers worked through the night to isolate compromised machines, disconnecting roughly 20 affected units from corporate and public networks.
According to Sabcobel, remediating the vulnerability permanently requires hardware intervention rather than a simple digital patch. Moelans noted that while physical modifications to field units are necessary, placing industrial cooling equipment behind dedicated, encrypted virtual private networks remains the fastest temporary safeguard for grocers.
In multiple stores, display cases reached temperatures between 50 and 55 degrees Celsius. Belgian outlets reported isolated cases reaching 70 degrees Celsius. The sudden heat melted packaging, flooded retail floors with defrost runoff, and ruined inventories before morning store personnel arrived.
Supermarket chains tally operational impact
In Belgium, the disruption struck dozens of franchise and corporate locations. Ahold Delhaize recorded intrusions across 40 Delhaize Proxy stores. A branch in Hoeilaart, Flanders, reported losing €100,000 in ruined stock, excluding revenue losses from emergency store closures. Delhaize also suspended digital ordering systems in neighboring Luxembourg to isolate its supply lines.
French retail group Carrefour reported that 15 of its Belgian Shop & Go convenience branches suffered cooling failures. Carrefour Belgium spokesperson Mich Vergauwen confirmed the disruption was deliberate, stating, “It’s a cyberattack, there is no other reason.” Colruyt Group confirmed five franchised Spar outlets suffered compromised cooling hardware, while 15 Intermarché stores and specialty butchery group De Laet en Van Haver also recorded outages.
In Sweden, the damage touched major national supermarket operators including ICA, Coop and distribution centers operated by Axfood. At an ICA Nära store in Böda, staff arrived Monday morning to find freezers reading 55 degrees Celsius and water standing across the aisles. An ICA branch in Sjöbo reported freezers held at 50 degrees overnight, forcing the site to close to clear spoiled goods.
Seven of Coop’s 800 Swedish shops suffered system tampering before engineers contained the incident. An Axfood home-delivery grocery warehouse in Gothenburg also saw freezer systems breached during the same operational window.
Cross-border spread across the continent
The perimeter of the attacks extended well beyond northern Europe. In Ireland, food wholesale and retail group Musgrave announced that 13 SuperValu branches suffered disruptions. Musgrave stated the breach was isolated to a specific connected controller model used across its estate.
In the Netherlands, Danish commercial refrigeration supplier Danfoss confirmed that at least 17 Dutch businesses suffered overnight cooling compromises, with local butcheries and neighborhood markets taking the brunt of the temperature spikes. Across the Baltic, Estonian commercial chilling firm Kitman Coldtech reported that an Estonian grocery chain had its store cooling hardware manipulated to 50 degrees Celsius.
Authorities have not yet attributed the intrusions to any specific nation-state or ransomware group. Belgium’s Centre for Cybersecurity confirmed it had opened an inquiry into the retail disruption, noting an accelerating frequency of operational intrusions aided by automated tooling. In Stockholm, John Billow, head of Sweden’s national cybersecurity centre, said officials had been advising commercial operators to audit exposed industrial hardware after discovering widespread vulnerabilities in operational technology across the country.
The widening risk to operational technology
Industrial refrigeration systems in modern supermarkets are rarely air-gapped. Retailers link temperature monitoring units, compressor racks and defrost cycles to cloud management portals so third-party engineering contractors can monitor energy efficiency, detect refrigerant leaks and schedule automated maintenance off-peak.
When these operational technology interfaces are exposed to the public internet without multi-factor authentication or isolated subnets, automated scanning utilities can discover them within hours. The vulnerability of internet-facing public hardware was similarly demonstrated during a recent digital billboard hack that took down outdoor infrastructure across several regions.
Security researchers are also studying parallels with unconfirmed cooling failures at US military base commissaries reported in August. For now, European grocers and commercial installers are continuing emergency network audits to sever public internet access to cooling compressors before additional retail chains suffer defrost sabotage.
