Cyberattacks hit supermarket refrigeration systems across Europe on Monday, raising temperatures and forcing retailers to discard food. The disruption affected major chains in Belgium, Luxembourg, Sweden and Ireland, weeks after similar attacks struck France.
At an ICA franchise in Stockholm, sales manager Engla Ingwall said the attack began at 2am, or 0100 GMT. Staff discovered the damage hours later.
“Everything is destroyed,” she said.
“There has been a cyberattack and all our freezers reached 50 degrees (Celsius).”
ICA confirmed an overnight incident affecting refrigeration at a limited number of stores. Sweden’s national cybersecurity centre began examining the incidents.
Major supermarket chains report disruption
Ahold Delhaize reported problems at dozens of stores in Belgium and Luxembourg. Colruyt confirmed attacks on five Belgian Spar shops.
Carrefour said the incident affected 15 of its 700 Belgian stores. IKEA confirmed disruption at one Belgian location and could not rule out problems elsewhere.
Sweden’s Coop reported unauthorised tampering at seven of its 800 stores. The company identified Danfoss among its refrigeration suppliers.
In Ireland, Musgrave withdrew some chilled and frozen products from 13 SuperValu stores.
Read More: French Supermarket Cyberattack Heats Fridges to 50°C
“Our monitoring systems alerted us to the issue and we took immediate action,” the wholesaler said. “Our investigation is ongoing.”
Belgian butcher Luc De Laet received an employee’s warning at 3:30am. He rushed to his shop south of Antwerp and found refrigeration temperatures reaching 18°C.
He estimated meat losses at €15,000, approximately $16,800, and contacted police.
“It’s very scary. They are hacking the system that is doing the registration of the temperature, and they can program it at a distance,” he said.
Investigators examine refrigeration controls
Some affected equipment used temperature-control technology from Danish manufacturer Danfoss. The company said it was helping customers implement fixes.
Earlier research by Claroty’s Team82 identified weaknesses in Danfoss refrigeration management systems. Danfoss addressed those findings through updated firmware. However, that research does not establish how attackers accessed systems in Monday’s incidents.
The attacks follow October’s disruption in France, where hackers seized supermarket cooling controls, causing food losses and fires. Ahold also reported a cybersecurity incident to police last month.
No group has claimed responsibility. Investigators have not established a connection between the latest attacks and the French incidents.
Food supply security concerns grow
Belgian cybersecurity spokesperson Katrien Eggers said investigators did not know who organised the attack. She also warned that artificial intelligence could help sophisticated actors exploit vulnerable systems.
SentinelOne researcher Tom Hegel said retail chains operate extensive networks of remotely managed equipment, making them attractive targets. He suggested the absence of financial demands could indicate sabotage, although investigators have confirmed no motive.
Read More: Google Gemini Hacked Three Companies During a Cybersecurity Test
European agriculture commissioner Christophe Hansen warned that repeated attacks threaten food supply chains and consumer confidence.
The incidents come amid heightened European concern over hybrid threats since Russia’s 2022 invasion of Ukraine. Moscow denies involvement in sabotage operations, and available evidence does not identify Russia as responsible for these attacks.
