COPENHAGEN/LONDON — Supermarkets across Europe are urgently reviewing their cybersecurity systems after a second wave of attacks exposed weaknesses in internet-connected refrigeration equipment, allowing hackers to remotely manipulate refrigerator and freezer temperatures and forcing retailers to remove or discard large quantities of food.
The latest incidents, reported on November 2, affected supermarkets and food businesses in eight European countries. Retailers in Sweden, Belgium, Luxembourg, Ireland, Estonia, Finland, the Netherlands and Germany reported disruptions involving refrigeration systems.
The attacks followed a similar incident in France in October, when hundreds of supermarkets and independent food retailers reportedly experienced refrigeration problems after attackers gained access to connected equipment.
With the latest incidents affecting multiple countries and competing supermarket chains, businesses are now moving beyond emergency repairs. They are checking their networks, upgrading older equipment, disconnecting vulnerable systems from the public internet and working with technology providers to prevent another wave of disruption.
The attacks have also raised a wider concern: ordinary equipment used to preserve food has become another potential entry point for cybercriminals.
SECOND WAVE OF ATTACKS HITS SUPERMARKETS ACROSS EUROPE
The November 2 incidents affected several major supermarket operators, including Sweden’s Coop and ICA, Germany’s Edeka, Belgium’s Carrefour and Ireland’s SuperValu.
In Sweden, Coop confirmed that seven of its stores were affected. The company said the refrigeration systems had been restored, but the affected equipment was disconnected from the internet while security checks continued.
ICA also reported problems involving 23 stores. The company said the affected equipment was connected outside its centrally managed store network.
In Germany, an Edeka store in Reisbach experienced a refrigeration-related cyber incident. The retailer explained that its network includes independently operated stores with different equipment and technology arrangements, making a uniform response more complicated.
Carrefour Belgium reported that 15 stores were affected.
In Ireland, Musgrave, the company behind the SuperValu supermarket chain, said refrigeration systems in 13 of its 223 stores had been affected. Chilled and frozen products were removed from sale as a precaution.
The incidents also affected businesses in Estonia, Finland, Luxembourg and the Netherlands.
The scale varied between operators. Some reported a limited number of affected locations, while others described disruptions across several dozen outlets or independent food businesses.
Although the incidents shared a similar pattern, investigators have not established whether every affected business was targeted by the same attackers.
HACKERS MANIPULATED TEMPERATURE SETTINGS REMOTELY
The reported attacks involved unauthorised interference with refrigeration controls.
Instead of simply disrupting a supermarket’s website or stealing customer information, attackers manipulated equipment responsible for keeping food chilled or frozen.
In some locations, temperatures reportedly climbed as high as 50 degrees Celsius, leaving products unsuitable for sale or requiring precautionary removal.
The systems involved are designed to let store operators and technicians monitor refrigeration performance, adjust temperatures and manage equipment remotely.
That convenience can become a serious weakness when the controllers are exposed to the public internet or protected by inadequate security measures.
If an attacker gains access, the controls can potentially be manipulated without physically entering the supermarket.
The result is a cyber incident with immediate physical and financial consequences.
Food that has been exposed to unsafe temperatures may need to be discarded, even if the refrigeration equipment is repaired shortly afterward.
Retailers must also consider food-safety procedures, replacement inventory, disposal costs and interruptions to normal operations.
RETAILERS DISCONNECT EQUIPMENT AND UPGRADE THEIR SYSTEMS
The attacks have prompted supermarket operators to review how their refrigeration systems communicate with external networks.
Coop in Sweden said it was switching from 4G connections to 5G networks and newer modems as part of its efforts to improve the security and reliability of its equipment.
The company had already begun the transition following the earlier French incident.
It also disconnected affected refrigeration systems from the internet while examining the wider network for potential weaknesses.
The review is important because a problem involving one store does not necessarily mean the rest of a supermarket chain is safe.
Many retailers operate hundreds of outlets, with some equipment managed centrally and other systems maintained by individual franchise owners or independent businesses.
A security weakness in equipment outside the main corporate network may therefore remain undetected unless the retailer checks its entire technology environment.
Other businesses are also working with suppliers and technicians to identify vulnerable refrigeration controllers and determine whether additional protective measures are needed.
DANFOSS WARNS CUSTOMERS AGAINST EXPOSING CONTROLLERS TO THE INTERNET
Danish engineering company Danfoss has been closely associated with the refrigeration systems involved in the incidents.
Its equipment is used in commercial refrigeration environments, including supermarkets and food businesses.
The company said it had been in contact with customers following the earlier attacks in France and was helping them respond to the latest developments.
Danfoss recommended that refrigeration controllers should not be directly accessible through the public internet.
Cybersecurity specialists have also advised retailers to identify which controllers are vulnerable, check whether they are exposed online and ensure that security updates are installed where available.
Frank Groenewegen, a cybersecurity expert at Deloitte in The Hague, urged retailers to act immediately rather than wait for another incident.
His warning highlighted a basic but important principle: refrigeration controllers should be accessible only through properly secured connections, not left directly exposed to anyone who can reach them online.
Danfoss is not the only technology provider mentioned in the wider incidents. Other refrigeration equipment and software platforms have also been identified in reporting about the attacks.
The involvement of a particular supplier, however, does not automatically establish that the manufacturer caused the incidents. Security depends on several factors, including equipment design, software support, network configuration and how customers manage access.
WHY DISCONNECTING THE FRIDGES IS NOT ENOUGH
Taking vulnerable refrigeration equipment offline can reduce the immediate risk of further remote interference.
However, cybersecurity specialists warn that disconnecting a device does not necessarily eliminate the weakness that allowed the attack in the first place.
A controller may still have outdated software, weak credentials or an insecure configuration.
If it is reconnected without proper remediation, the same weakness could remain available to attackers.
Groenewegen explained that disconnecting equipment helps isolate it from immediate threats, but does not resolve the underlying security problem.
Retailers therefore need to examine the entire system rather than rely on a temporary network shutdown.
That process may involve installing security updates, changing credentials, reviewing remote-access permissions, replacing unsupported equipment and introducing secure connections for technicians.
Businesses must also establish which systems are still supported by their manufacturers.
Older equipment can be especially difficult to secure when software updates are no longer available.
For supermarkets, replacing refrigeration technology is not a simple decision. Equipment must operate continuously, and major upgrades can require significant spending and careful coordination across multiple stores.
Nevertheless, the latest incidents show the potential cost of postponing those investments.
INDEPENDENT STORES MAKE THE PROBLEM MORE COMPLICATED
One of the biggest challenges facing European supermarket groups is that not every store operates under the same technical arrangements.
Many supermarket networks include independently owned or franchised outlets.
These stores may use different refrigeration systems, maintenance providers, internet connections and remote-management arrangements.
ICA said the affected stores had equipment connected outside its centrally managed store network.
Edeka also pointed to the lack of standardised refrigeration systems across its independently operated locations.
This creates a complicated cybersecurity environment.
A retailer may have strong protection for its central corporate network but still face weaknesses in equipment managed by individual store owners or external contractors.
The situation makes it difficult to guarantee that every location follows the same security standards.
It also complicates investigations because different stores may use different controllers and network configurations.
For large supermarket groups, protecting the entire operation requires cooperation between headquarters, franchise operators, equipment manufacturers and maintenance providers.
SWEDISH POLICE EXPECT MORE REPORTS AS INVESTIGATIONS CONTINUE
The attacks have also triggered investigations by law enforcement and cybersecurity authorities.
Swedish police said approximately 10 reports had been filed following the latest incidents and expected additional complaints.
Investigators will need to establish how the attackers accessed the refrigeration systems, whether the same weaknesses were exploited across different businesses and whether the incidents were connected.
The fact that similar disruptions occurred across several countries does not, by itself, prove that a single group coordinated every attack.
Different attackers could exploit the same weaknesses, particularly when similar equipment and remote-access practices are used by multiple retailers.
Authorities and affected businesses will also need to preserve technical evidence to determine how the intrusions occurred.
Identifying the perpetrators may be difficult, especially if the attackers used compromised accounts, remote infrastructure or techniques designed to hide their identities.
As of the latest reports, no group had publicly claimed responsibility for the November incidents.
EUROPEAN CYBERSECURITY AGENCY CALLS FOR COORDINATED ACTION
The European Union Agency for Cybersecurity, known as ENISA, said the large-scale incidents affecting retail businesses across several member states demonstrated the importance of European cooperation.
The agency stressed the need for rapid information-sharing and coordinated responses to cyber incidents.
This is particularly important because retailers, technology providers and cybersecurity authorities may be dealing with the same vulnerabilities across national borders.
Information from one affected business could help another identify and secure similar equipment before it is targeted.
The UK’s National Cyber Security Centre also said it was on heightened alert and working with organisations to identify weaknesses and close them before attackers could exploit them.
NCSC chief executive Richard Horne warned that attacks on supermarket refrigeration systems could be an early indication of more frequent disruptions as older technology struggles to keep pace with cyber threats.
The warning reflects a growing concern about operational technology: the digital systems that control physical equipment and industrial processes.
A successful attack on these systems can have consequences far beyond a conventional data breach.
THE FRENCH INCIDENT SHOWED HOW WIDESPREAD THE DAMAGE COULD BECOME
The latest wave follows a major refrigeration-related cyber incident in France in October.
Hundreds of supermarkets and independent grocery businesses reportedly experienced disruptions after attackers interfered with refrigeration equipment.
The incident demonstrated how a weakness in commonly used technology could affect multiple businesses in a short period.
It also prompted retailers and suppliers to review the security of their equipment.
The November attacks suggest that the lessons from France had not yet translated into adequate protection across every affected business.
Some retailers had already started upgrading their systems, while others continued operating equipment that remained vulnerable.
The repeated incidents have therefore increased pressure on supermarket operators to accelerate security improvements.
For additional background, WWC ONE MEDIA previously reported on the earlier incident in Hackers Target Supermarket Fridges Across Europe — Could Food Supply Chains Face a Bigger Cyber Threat?.
The latest developments make that earlier warning more urgent: the problem is no longer simply whether refrigeration equipment can be hacked, but how many businesses remain exposed.
WHO IS RESPONSIBLE FOR THE ATTACKS?
Despite the growing number of affected businesses, the identity and motives of the attackers remain unclear.
No organisation has publicly claimed responsibility for the latest incidents, and authorities have not confirmed a link between the November attacks and the earlier French operation.
Cybersecurity experts have discussed several possible motives, including deliberate disruption, sabotage and financial gain.
However, the absence of a publicly reported ransom demand does not establish why the attackers acted.
There has also been speculation about whether the incidents could be connected to state-sponsored cyber activity.
No confirmed evidence has established that a particular government was behind the supermarket attacks.
It is important to distinguish between the possibility of geopolitical involvement and a verified attribution by investigators.
For now, the immediate priority for affected retailers is to secure their systems and prevent further damage while authorities examine the available evidence.
COULD THE ATTACKS AFFECT EUROPE’S FOOD SUPPLY?
The incidents have not established that Europe is facing a continent-wide food shortage.
However, they have demonstrated how a cyberattack on an apparently ordinary business system can disrupt an essential part of food retailing.
Supermarkets depend on refrigeration to preserve meat, dairy products, seafood, frozen goods and other perishable items.
If multiple outlets experience refrigeration failures at the same time, retailers may face significant inventory losses and additional pressure on suppliers.
The risks extend beyond supermarkets.
Butcher shops, food warehouses, distribution facilities and other businesses that depend on temperature-controlled storage also use connected equipment.
If similar weaknesses exist across these environments, the potential consequences could extend beyond individual retail outlets.
The concern is particularly serious for smaller businesses that may lack dedicated cybersecurity teams or the financial resources to replace ageing equipment quickly.
For European retailers, the latest incidents are a reminder that food security depends not only on production and transportation but also on the reliability of the digital systems supporting storage and distribution.
WHAT SUPERMARKETS MUST DO NEXT
The response will require more than replacing damaged food or restoring refrigeration equipment.
Retailers need to establish a clear picture of every connected controller operating across their businesses.
They must identify unsupported devices, close unnecessary internet access, apply available security updates and ensure that remote maintenance connections are properly protected.
Access should also be limited to authorised personnel, with stronger authentication and monitoring where appropriate.
For independently operated stores, supermarket groups may need common security standards and regular checks to ensure that franchisees and external contractors follow the same basic protections.
Equipment manufacturers and maintenance providers also have a role in communicating vulnerabilities and helping customers install appropriate fixes.
The challenge is not limited to large companies. Small grocery businesses may need technical assistance to secure systems that they have relied on for years.
The attacks show why cybersecurity must become part of routine equipment maintenance rather than a response reserved for emergencies.
THE BOTTOM LINE
European supermarkets are now confronting a problem that reaches beyond stolen customer information or disrupted online services.
Hackers have demonstrated that remotely connected refrigeration equipment can become a target, potentially turning a digital security weakness into spoiled food, financial losses and operational disruption.
The latest wave affected retailers in eight European countries, including Sweden, Belgium, Germany and Ireland. Businesses are responding by disconnecting vulnerable equipment, upgrading connections, reviewing access controls and working with suppliers to identify weaknesses.
But the response will take time, particularly where stores rely on older systems or independently managed equipment.
The warning from cybersecurity experts is clear: isolating a vulnerable controller may stop an immediate attack, but retailers must also fix the underlying weaknesses before reconnecting it.
The bigger question is whether the food industry can secure its increasingly connected infrastructure before another coordinated wave of attacks causes even greater disruption.
If hackers can remotely change the temperature inside supermarket freezers, what other essential systems could become their next target — and are businesses moving quickly enough to protect them?
