Second wave of cyberattacks disables supermarket freezers across seven European countries

A second wave of cyberattacks has struck supermarket refrigeration systems across at least seven European countries overnight, forcing freezers into defrost mode, spiking temperatures, and destroying large quantities of food.

The attack method involved remotely switching evaporators to defrost mode, causing refrigeration units to warm rapidly. In several shops, freezer temperatures were raised to 50C. The affected countries include Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands, and Sweden, with retailers across the continent confirming disruptions on Monday.

Store-by-store damage across the continent

Ahold Delhaize reported that roughly 40 of its supermarkets in Belgium and Luxembourg were affected. Carrefour Belgium said disruption hit about 15 of its stores, with spokesperson Mich Vergauwen stating: “It’s a cyber-attack, there is no other reason.” Colruyt Group confirmed five Spar shops in Belgium had their fridge systems attacked. Ikea’s store in Mons, Belgium, was also hit, with the company removing some food products as a precaution. A Delhaize branch in Hoeilaart, Flanders, reported losing €100,000 worth of produce, an estimate that did not account for further losses from closing the shop. Belgium’s Le Soir newspaper reported that affected stores also included Shop & Go convenience stores attached to Q8 service stations and some smaller Proxy Delhaize mini-markets. At a store north-east of Brussels, reporters found empty shelves and a sign reading: “Due to cyberattacks, there will be no products on the refrigerated or freezer shelves. We offer our sincere apologies.”

In Sweden, an ICA store in Sjöbo posted on social media that its fridges and freezers had been hacked and the temperature set to 50C. Another ICA store in Stockholm said its freezers were broken due to a 2am cyberattack and that “everything was destroyed.” Coop Sweden said seven of its 800 stores were affected and that the situation was contained. In the Netherlands, at least 17 mainly small local stores were hit, including butcher shops and small neighbourhood stores. Ireland saw 13 SuperValu supermarkets affected, with the impact limited to a specific model of refrigerator. In Estonia, attackers accessed a computer controlling the refrigeration system at a Selver supermarket and turned the temperature to 50C; Jann Mutso, CEO of refrigeration supply company Kitman Coldtech, said the attack was responded to within minutes with no significant damage. In Finland, stores operated by the Kesko supermarket chain were investigating similar refrigeration problems.

Stephan Moelans, CEO of Sabcobel, which operates Delhaize’s refrigeration systems, confirmed the incident was a cyber-attack. “We started mobilising technicians at 1am,” he said. “We spent all night and morning disconnecting the affected installations.” Moelans said that since the French attack in early October, the company had been working to protect customers’ fridges but that the units needed physical modifications, not just software updates. Ahold Delhaize spokesperson Sarah De Meester said the range of fresh and frozen products was “temporarily somewhat limited” in affected stores, but distribution centres were operating normally and there was no disruption to deliveries.

October attack in France set the pattern

The November wave follows a similar attack in France in early October that hit as many as 700 supermarkets. Hackers remotely overrode settings on freezers, fridges, and chiller cabinets at chains including Intermarché, Coopérative U, Carrefour, Leclerc, and Monoprix, pushing temperatures from as low as -27C to well over 50C. The attack caused fires as well as food losses estimated in the tens of millions of euros. Individual supermarkets reportedly suffered losses ranging from tens of thousands of euros to more than €130,000. The Paris prosecutor’s office opened a formal investigation, and Minister of the Armed Forces Sébastien Lecornu instructed France’s cybersecurity agency, ANSSI, to investigate. ANSSI subsequently reported that supermarkets using controllers from two other companies had also been targeted in the attack.

Why cold-chain controllers are exposed

Most supermarket refrigeration systems across Europe are linked to the internet for remote maintenance and troubleshooting, making them reachable by attackers who know how to exploit the connection. Danfoss, a Danish manufacturer, supplied the controllers targeted in the French attack. Danfoss said it had identified some security flaws last year and had “long recommended” customers install updates. However, security researchers said Danfoss was no longer providing security updates for the affected units. Security company Claroty warned in August that those refrigerator units were at risk of remote hacks and outages. Patrick Lamplmair of cybersecurity firm Tributech said thousands of controllers were still reachable from the internet after the French attack. “A few commands to a temperature controller can destroy stock overnight and close stores,” he said.

No claims of responsibility

It remains unclear who is behind the attacks, and there have been no claims of responsibility. Tom Hegel of cybersecurity firm SentinelOne said the supermarket attacks, with no financial demands, point to sabotage. US authorities are investigating refrigeration malfunctions at American military bases and working with French officials to examine possible links. Belgium and Sweden’s national cyber-security agencies said they were monitoring the incident. The UK’s National Cyber Security Centre said it was working with international partners and industry to understand the incident, though no incidents have been reported in the UK.