A cyberattack targeting internet-connected refrigeration and freezer systems has disrupted supermarket operations across seven European countries, affecting dozens of retail locations and raising concerns about the security of remotely managed equipment. Around 40 Delhaize supermarkets in Belgium and Luxembourg were affected, while other incidents were reported in Sweden, Ireland, the Netherlands, Estonia and Finland. The attack reportedly caused refrigeration units to switch their evaporators into defrost mode, raising temperatures and putting stored food at risk. The incident appears to follow a similar attack in France in early October, when hundreds of supermarkets experienced refrigeration disruptions and millions of euros worth of food reportedly had to be discarded.
Belgian refrigeration manufacturer Sabcobel confirmed that the latest incident was a cyberattack affecting some of its equipment. Stephan Moelans, the company’s chief executive, told the Belga news agency that teams had worked through the night and into the morning to disconnect affected units from the network. He explained that Sabcobel had been working to protect customer refrigeration systems against the vulnerability identified after the French incident, but that the required changes involved physical modifications rather than software updates alone. The company operates systems used by Delhaize, and the latest attack has highlighted the risks associated with equipment that can be monitored and maintained remotely. Many supermarkets rely on internet-connected refrigeration systems so technicians can carry out troubleshooting and maintenance without visiting individual stores. Moelans said many customers had moved to managing their refrigeration equipment through secure internet connections following the earlier incident. However, the latest disruption indicates that securing network access may not be sufficient where vulnerabilities also require changes to the physical equipment. Reports indicated that temperatures in some affected freezers and refrigerators rose as high as 50 degrees Celsius, creating the possibility of extensive food spoilage.
The impact extended beyond Delhaize stores. Carrefour confirmed that 15 of its Belgian supermarkets had been affected, adding that immediate measures were taken to keep all its stores operational. Colruyt Group, which operates Spar stores in Belgium through a franchise system, reported that five shops had experienced attacks on their refrigeration systems. Ikea also confirmed that refrigeration equipment at its store in Mons, western Belgium, was affected and said it could not rule out further locations being impacted. In Flanders, a Delhaize branch in Hoeilaart estimated that it had lost approximately €100,000 worth of produce, excluding potential additional losses associated with closing the store. In Sweden, several ICA and Coop supermarkets reported disruptions. ICA said a small number of stores operating outside its central network had been affected and that it was supporting those locations. An ICA branch in Sjöbo reported that its refrigerators and freezers had been hacked overnight, with temperatures reportedly changed to 50 degrees Celsius. The store temporarily closed before reopening. Seven of Coop’s approximately 800 Swedish stores were also affected, although the company said the situation was contained and under control.
Other affected retailers and businesses were reported across the region. In Finland, refrigeration malfunctions were detected at some K-stores operated by Kesko, whose security specialists began investigating the cause. In Ireland, 13 SuperValu supermarkets were affected by what Musgrave Group described as a cyber incident involving refrigeration systems. The company said the impact was limited to a specific refrigerator model. In the Netherlands, Danish manufacturer Danfoss told public broadcaster NOS that the freezing and cooling systems of at least 17 businesses had been attacked, including butcher shops and small neighbourhood stores. Estonia also reported an affected Selver supermarket, alongside reports of disruptions at other businesses. The range of affected retailers demonstrates how attacks on connected equipment can extend beyond large supermarket chains to smaller businesses that depend on the same types of remotely managed systems.
The identity of those responsible for the latest attack remains unknown. Belgium’s and Sweden’s national cybersecurity agencies said they were monitoring the situation, while the UK’s National Cyber Security Centre confirmed that it was working with international partners and industry representatives to understand the incident. No related incidents had been reported in the UK at the time of the reports. Separately, authorities in the United States have been investigating refrigeration malfunctions at several American military bases in August and working with French officials to examine whether those incidents could be connected. No confirmed link between those investigations and the European supermarket attacks has been established. The incidents have drawn attention to the cybersecurity risks facing operational technology and internet-connected equipment used in essential business operations. Refrigeration systems may not traditionally be viewed as high-profile digital infrastructure, but their disruption can affect food safety, supply chains, business continuity and financial performance. The latest attacks underline the importance of securing remote access, addressing vulnerabilities that require hardware changes and ensuring that connected equipment is protected against unauthorized control.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
