STOCKHOLM/BRUSSELS/LONDON — Supermarkets and grocery businesses across Europe are investigating a new wave of cyberattacks after hackers allegedly manipulated refrigeration and freezer systems, causing temperatures to rise and forcing retailers to remove or discard chilled and frozen food.
The incidents were reported on Monday, November 2, affecting businesses in at least seven European countries: Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands and Sweden. Portugal was also included in reports of affected retailers, bringing the number of countries mentioned in some coverage to at least eight.
Retailers and businesses affected included Ahold Delhaize, Colruyt, ICA, Coop, Carrefour and Musgrave. IKEA also confirmed that one of its Belgian stores had been hit.
In some locations, refrigeration temperatures reportedly climbed as high as 50 degrees Celsius, leaving food unsuitable for sale or requiring precautionary removal.
The latest incidents follow a similar attack in France in October that reportedly affected hundreds of supermarkets and independent grocery stores.
No group has claimed responsibility for the latest incidents, and investigators have not established whether the attacks across different countries were carried out by the same perpetrators.
The developments are raising concerns about the cybersecurity of everyday retail equipment and the potential consequences for businesses that increasingly depend on remotely managed systems.
Supermarket Fridges and Freezers Hit Across Europe
The latest incidents were reported across several European countries, with Belgium and Sweden among the most visibly affected.
In Sweden, grocery chains ICA and Coop reported refrigeration problems involving a limited number of outlets.
At an ICA franchise store in Stockholm, sales manager Engla Ingwall told Reuters that the incident occurred at approximately 2 a.m. but was only discovered several hours later.
She said the store’s freezers had reached temperatures of approximately 50 degrees Celsius.
ICA confirmed that a limited number of stores had experienced an overnight incident affecting refrigeration and freezer systems. However, the company did not independently confirm that every affected outlet had been hacked.
The Swedish grocery group Coop confirmed that six of its approximately 800 stores had been affected by a cyber incident involving unauthorised interference with cooling systems. Other reporting placed the number at seven, reflecting differences in the figures reported by the company and media outlets.
In Belgium and Luxembourg, supermarket groups Ahold Delhaize and Colruyt reported disruptions affecting refrigeration systems in several outlets.
Colruyt Group said five stores had experienced problems involving their refrigeration systems.
Carrefour Belgium confirmed that approximately 15 of its 700 stores had been affected.
IKEA also reported that one of its Belgian stores in Mons had experienced a cyberattack that caused freezer temperatures to rise.
The scale varied between retailers, with some reporting only a handful of affected locations while others described problems across dozens of outlets.
Ireland, Portugal and Other Countries Also Report Disruptions
The impact extended beyond Sweden and Belgium.
Irish food wholesaler Musgrave, which owns the SuperValu grocery chain, said refrigeration systems in 13 of its stores had been affected.
The company removed some chilled and frozen products from sale as a precaution while investigating the incident.
It said monitoring systems detected the problem and staff took immediate action. The company also reported that the incident had been resolved and that restocking was underway.
In Portugal, the Mosqueteiros group reported incidents affecting seven Intermarché stores. The company said the attack appeared to have targeted an external service provider responsible for managing refrigeration systems.
Reports also emerged from Estonia, Finland and the Netherlands.
In Estonia, at least one supermarket experienced interference involving its refrigeration equipment. The incident was reportedly stopped within minutes, with no significant damage reported.
Finnish retailer Kesko said irregular temperatures had been detected in a small number of grocery stores and that investigators had not ruled out interference through the network.
In the Netherlands, refrigeration equipment supplier Danfoss confirmed attacks affecting 17 businesses, mainly smaller stores and butcher shops.
The incidents demonstrate how a problem involving ordinary store equipment can create disruption across several countries when businesses depend on connected technology.
However, the number of affected countries and outlets varies between reports because some businesses confirmed cyberattacks while others were still investigating technical problems.
Food Losses Mount as Stores Remove Products
The immediate consequence has been the loss of chilled and frozen food.
Supermarkets affected by the incidents had to empty refrigeration units, remove products from sale and arrange replacement stock.
At an ICA Kvantum store in Sjöbo, Sweden, employees were seen clearing frozen products after refrigeration systems were affected.
The incident also hit smaller food businesses.
Luc De Laet, founder and owner of Belgian butchery chain De Laet & Van Haver, told Reuters that he was alerted to the problem early in the morning.
After arriving at his store south of Antwerp, he found that refrigeration temperatures had risen significantly.
He estimated that approximately €15,000 worth of meat had been ruined.
The financial impact highlights why refrigeration is critical to grocery businesses.
Unlike many other forms of retail inventory, perishable products can quickly become unsuitable for sale when temperature controls fail.
Businesses must also consider the cost of replacement products, interrupted operations, disposal and potential losses from customers who cannot access their usual supplies.
The total financial damage from the latest wave of incidents has not yet been established.
A Similar Attack in France Affected Hundreds of Stores
The latest European incidents follow another major refrigeration-related cyberattack in France on October 12.
French authorities said hackers had taken control of cooling systems at hundreds of supermarkets and independent grocery stores.
The affected equipment experienced abnormal temperature changes, forcing retailers to discard food and temporarily close or restrict access to some refrigerated sections.
Reports linked to the French investigation identified approximately 700 affected locations.
The incident raised concerns about weaknesses in connected refrigeration equipment, particularly older systems that may no longer receive regular software and security updates.
The October incident also reportedly caused fires at some affected locations, according to reporting on the French investigation.
The latest attacks appear to have followed a similar pattern, with refrigeration settings manipulated remotely.
However, investigators have not established whether the October incident in France and the November incidents across Europe were carried out by the same attackers.
Older Refrigeration Technology Raises Cybersecurity Concerns
Danish technology company Danfoss has been mentioned in connection with several of the affected refrigeration-control systems.
The company previously said that many of the systems affected in France were legacy products that no longer received software or security updates.
Danfoss equipment was also identified in connection with some of the latest incidents.
In Estonia, a refrigeration industry representative said the affected equipment involved older systems supplied by the company.
However, the presence of the same supplier does not establish that every incident involved the same vulnerability or that the manufacturer was responsible for the attacks.
The incidents have instead highlighted a wider issue facing businesses that rely on older connected equipment.
Some refrigeration systems were designed and installed long before cybersecurity became a central consideration in commercial building management.
When equipment remains connected to a network after its original support period ends, businesses may face additional challenges in maintaining security.
Replacing or upgrading these systems can also involve significant costs, particularly for retailers operating hundreds of stores.
Why Supermarket Refrigeration Systems Have Become a Cybersecurity Concern
Modern supermarkets rely on technology to manage far more than checkout counters and online orders.
Refrigeration systems, heating and ventilation equipment, security cameras, alarms and building-management systems can all be connected to digital networks.
These systems allow businesses to monitor equipment and manage operations across multiple locations.
But increased connectivity also creates cybersecurity risks.
If unauthorised parties gain access to poorly protected systems, the consequences may extend beyond stolen information or temporary website disruptions.
In the supermarket incidents, the reported interference affected the physical operation of refrigeration equipment.
That meant a digital security problem could directly damage inventory and interrupt normal business activities.
The issue is particularly important for operational technology, which refers to digital systems that monitor or control physical equipment.
Unlike ordinary office computers, these systems can influence real-world processes, including temperature regulation and industrial operations.
Cybersecurity specialists have warned that retailers operate extensive networks of connected equipment, making it difficult to maintain consistent security across every location.
The growing reliance on remote management also means that businesses must consider the security of equipment supplied and maintained by external technology providers.
Who Is Behind the Attacks?
The identity of those responsible remains unknown.
No group has publicly claimed responsibility for the latest incidents, and investigators have not established whether the attacks were connected to the October incident in France.
Belgian cybersecurity officials have expressed concern about the growing number of incidents involving connected infrastructure.
Belgium’s Centre for Cybersecurity has warned that the incidents deserve attention as businesses increasingly depend on remotely managed equipment.
Cybersecurity experts have discussed several possible motives, including financial extortion and deliberate disruption.
Some researchers have noted that the absence of publicly reported ransom demands in the latest cases could point to motives other than conventional financial extortion.
However, this remains an interpretation rather than a confirmed explanation.
There is also no independently established evidence linking the attacks to Russia or any other government.
The wider geopolitical environment has increased attention on cyber threats to European infrastructure, but investigators have not attributed the supermarket incidents to a particular state actor.
European Commission Warns About Food Supply Chain Risks
The incidents have also attracted attention from European Union officials.
EU Agriculture Commissioner Christophe Hansen said repeated attacks against supermarket refrigeration systems were deeply concerning because they could disrupt food distribution and undermine consumer confidence.
He described the incidents as a warning that food supply chain security requires greater attention.
Although the latest attacks have not established a wider shortage of food across Europe, they demonstrate how vulnerable individual businesses can be when important equipment becomes unavailable.
Food supply chains depend on several interconnected stages, including storage, transportation, distribution and retail sales.
A disruption at any of these stages can create additional costs and delays.
For supermarkets, maintaining reliable refrigeration is essential to preserving food quality and ensuring products remain suitable for sale.
The concern is therefore not limited to the affected shops. Repeated disruptions could place additional pressure on suppliers, retailers and businesses responsible for maintaining cold-storage equipment.
What Retailers Are Doing to Respond
Affected businesses have been working to restore refrigeration systems, remove unsuitable products and assess the extent of the disruption.
Some retailers said their monitoring systems detected abnormal conditions and allowed staff to respond.
In Ireland, Musgrave said it had removed affected chilled and frozen products from sale and was working to restore normal operations.
In Sweden, Coop said its affected refrigeration systems had returned to normal.
Technology suppliers have also been working with customers to address weaknesses in affected equipment.
However, the incidents raise broader questions about how retailers manage older technology and whether existing security arrangements are sufficient for equipment connected to corporate networks.
Businesses must consider cybersecurity as part of their operational planning, rather than treating it as an issue limited to computers, websites and customer databases.
The attacks also highlight the importance of contingency arrangements for refrigeration failures, particularly when large quantities of perishable goods are involved.
Could This Become a Bigger Threat to Europe’s Food Industry?
The latest incidents show how cyberattacks can create real-world financial and operational consequences without directly targeting food production.
Supermarkets may lose inventory, businesses may be forced to close affected sections and suppliers may face additional pressure to replace discarded products.
For smaller grocery operators, even one major refrigeration incident can create significant financial difficulties.
The concern is not necessarily that Europe is facing an immediate food shortage.
Rather, it is that connected equipment used throughout the food industry could become a source of disruption if cybersecurity weaknesses remain unaddressed.
The earlier French attack and the latest incidents across Europe have placed renewed attention on the need to protect industrial and commercial technology.
The issue also connects to a broader pattern of cyber incidents affecting companies and public institutions. WWC ONE MEDIA previously examined this in Coupang Launches External Security Committee After Massive Data Leak, which explored how a major retailer responded to a serious information-security incident.
Other cases have shown how attacks can affect systems beyond traditional consumer databases. Read LTFRB Data Breach Confirmed — But the Biggest Question Is Still Unanswered for another example of a cyber incident disrupting an essential service.
For retailers, the challenge now extends beyond restoring damaged refrigeration systems.
They must also establish whether their connected equipment can be trusted, whether security protections are adequate and how quickly operations can recover if another incident occurs.
As investigations continue, one question remains central: if a supermarket’s refrigeration network can be disrupted remotely, how prepared is the wider food supply chain for similar digital threats?
