Cyber-Attack Disrupts Supermarket Refrigeration in Seven European Countries

Preface

Supermarkets in seven European countries have reported cyber-related disruptions to refrigeration systems, leaving some refrigerators and freezers unable to maintain safe temperatures. The incident affected stores in Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia, and Finland. Reports indicate that equipment was switched into defrost mode, causing temperatures to rise and raising concerns about food losses and store operations.

The event has renewed attention to the security of internet-connected refrigeration equipment. Many supermarkets rely on remote monitoring and maintenance, which can make operations more efficient but also create potential vulnerabilities. This article summarizes the reported effects, responses from retailers and manufacturers, and the broader investigations, while distinguishing confirmed statements from details that remain unclear.

Lazy bag

Supermarket refrigeration systems in seven European countries were reportedly disrupted in a cyber-attack. Around 40 Delhaize supermarkets in Belgium and Luxembourg were affected, alongside stores operated by several other chains. The reported method involved switching refrigerator evaporators to defrost mode, causing units to warm. Retailers and authorities said they were responding, while the identity of those responsible remained unknown. The incident follows a similar event affecting hundreds of French supermarkets in October, which reportedly led to millions of euros worth of food being discarded. The episode highlights the need to secure connected equipment and prepare for operational disruption.

Main Body

Supermarkets across seven European countries have been affected by a cyber-attack targeting refrigeration systems. The reported disruptions involved refrigerators and freezers, essential equipment for preserving fresh and frozen food. Around 40 Delhaize supermarkets in Belgium and Luxembourg were affected, while a smaller number of stores in Sweden, Ireland, the Netherlands, Estonia, and Finland also reported problems.

Sabcobel, a Belgian company that manufactures some of the affected refrigerators, said the units’ evaporators had been switched into defrost mode. In normal operation, defrost cycles help prevent ice from building up on cooling equipment. In this incident, however, the setting caused the affected units to warm up. The reported method is believed to be the same as that used in an incident in France last month, which affected hundreds of supermarkets. Local media reported at the time that millions of euros worth of food had to be thrown away.

Stephan Moelans, the chief executive of Sabcobel, which operates Delhaize’s systems, told the Belga news agency on Monday that the incident was a cyber-attack. He said the company had been “working all night and morning to disconnect the affected units from the network.” His remarks indicate that the immediate response focused on isolating vulnerable equipment to limit further interference.

Moelans said that after the French attack in early October, Sabcobel had been working to “protect our customers fridges against this vulnerability.” He added that the affected units required physical modifications, rather than software updates alone. This distinction matters because security measures that rely only on remote software changes may not address weaknesses in the hardware or its configuration. The company’s response suggests that protecting connected refrigeration equipment can require changes to the equipment itself as well as to the way it is managed.

Most supermarkets across Europe have internet-connected systems, enabling maintenance and troubleshooting to be carried out remotely. Remote access can help technicians identify faults and support stores without visiting each location. At the same time, a network connection can expose operational equipment to cyber risks if access is not sufficiently protected. Moelans described secure connectivity as the simplest way to manage refrigerators and said most of Sabcobel’s customers had switched to a secure internet connection after the attack in France.

Reports said the temperature of freezers in several shops across Europe rose as high as 50C (122F). Such a rise can put stored goods at risk, although the precise extent of losses across all affected retailers has not been established. The identity of those behind the latest apparent attack is also unclear. Authorities and businesses are therefore dealing both with immediate operational issues and with unanswered questions about how the disruption occurred.

The incident has drawn attention beyond Europe. In the US, authorities are investigating refrigeration malfunctions at a number of American military bases in August. They are working with French officials to examine whether those incidents could be linked. No connection has been confirmed in the information reported, and the investigation remains ongoing.

National cyber-security agencies in Belgium and Sweden said they were monitoring the incident. The UK’s National Cyber Security Centre said it was working with international partners and industry to “fully understand details of an incident.” No incidents have been reported in the UK. These statements show that officials are following developments across borders, while the available accounts do not establish a single confirmed explanation for every affected location.

In Flanders, northern Belgium, a Delhaize branch in Hoeilaart told the news website Het Laatste Nieuws that it had lost €100,000 (£83,500) worth of produce. Its manager said the estimate did not include further losses expected from closing the shop. The example illustrates how disruption can affect a retailer in more than one way: spoiled stock may create direct losses, while temporary closure can also reduce business and complicate supply operations.

Carrefour, the French-owned supermarket, said the incident affected only 15 of its Belgian stores. It added that measures were taken immediately to ensure all its shops remained open. A spokesperson for Colruyt Group, which operates Spar stores in Belgium under a franchise system, told Reuters that five shops had their refrigerator systems attacked. These reports show that the effects varied between retailers and locations.

Swedish stores also reported problems. Ikea, the budget furniture retailer, said refrigeration systems at its store in Mons, in western Belgium, were affected. A spokesperson quoted by Reuters said the company could not rule out the possibility that additional locations might be affected. In Sweden, several ICA and Coop shops were hit. An ICA spokesperson confirmed that a “small number of ICA stores operating outside ICA’s central network” had been affected and said ICA was supporting those stores in managing the situation.

An ICA branch in Sjöbo, southern Sweden, posted on social media that its refrigerators and freezers had been hacked overnight and that their temperature had been set to 50 degrees. The store closed earlier but later reopened to customers. Coop said seven out of its 800 stores in Sweden were affected, adding that the “situation is currently contained and under control.” The statements suggest that individual chains were assessing the extent of the disruption and taking steps to resume normal operations.

In neighbouring Finland, refrigerator malfunctions were detected in some K-stores. The owner of the Kesko supermarket chain was quoted by the Finnish newspaper Helsingin Sanomat as saying that its security experts were investigating the cause. The available report did not specify how many stores were affected or whether the malfunction had the same technical cause as the incidents reported elsewhere.

The attack also affected retailers in Ireland, the Netherlands, and Estonia. In Ireland, 13 SuperValu supermarkets were affected. A spokesperson for Musgrave Group, which owns the chain, confirmed to The Irish Times that a “cyber incident” affected refrigeration systems, but said the impact was limited to a “specific model” of refrigerator.

A spokesperson for Danish manufacturer Danfoss told Dutch public radio channel NOS that the freezing and cooling systems of at least 17 companies in the Netherlands were attacked overnight. The affected businesses included butcher shops and small neighbourhood stores, showing that the disruption extended beyond large supermarket chains. In Estonia, a Selver supermarket was affected, and ERR reported that other companies in the country may also have experienced problems.

Across the affected countries, the incident highlights the operational importance of securing equipment that is connected to business networks. Refrigeration units are not merely supporting technology: their performance directly affects food safety, stock, store availability, and costs. Remote management can make maintenance easier, but the reported need for physical modifications and network disconnection underscores that security planning must account for both software and equipment. Investigations and responses are continuing, while the attacker’s identity and the full scale of the effects remain uncertain.

Key Insights Table