Hackers hit supermarket fridges across Europe in a second wave

Supermarkets in at least six European countries threw away spoiled food on Monday, Nov. 2, after hackers took remote control of their refrigeration systems overnight and drove up temperatures in fridges and freezers. It was the second such wave in three weeks. In mid-October, an attack on refrigeration controllers hit about 700 supermarkets in France.

Stores in Sweden, Belgium, Luxembourg, Ireland and Estonia were affected, The Associated Press reported. NBC News and Reuters also reported incidents in the Netherlands. Authorities have not said who was behind the attacks, and no group has claimed responsibility, according to NBC News.

What to know

• When: Overnight Sunday into Monday, Nov. 2. One Stockholm store manager told Reuters the attack began around 2 a.m. local time.
• Where: Sweden, Belgium, Luxembourg, the Netherlands, Ireland and Estonia, according to AP, NBC News and Reuters. Other outlets reported cases in Finland, Portugal and Italy.
• What happened: Attackers raised fridge and freezer temperatures, in some stores to 50 degrees Celsius (122 degrees Fahrenheit), and stores discarded the affected food.
• Who was hit: Delhaize, Carrefour, Colruyt's Spar stores and an Ikea store in Belgium; ICA and Coop in Sweden; 13 SuperValu stores in Ireland; and one Selver store in Estonia.
• Equipment: At least some of the affected units used temperature-control technology from Danish firm Danfoss, which was also targeted in the French attack, according to Reuters.
• Who did it: Unknown. Belgium's Centre for Cybersecurity said "it may never be determined."

Which countries and stores were hit?

Sweden. The ICA Group said "a limited number" of stores were affected overnight, spokesperson Gustaf Nilsson told the TT news agency, according to AP. An ICA Kvantum store in Sjöbo, in southern Sweden, said on Facebook that its fridges and freezers had been hacked and set to 50 degrees Celsius, and that staff were discarding products. ICA told NBC News that its own systems were not affected. It said the incident hit "a small number of stores that use an external supplier and have their connectivity outside ICA's central network." Coop said seven of its roughly 800 stores were affected by unauthorized tampering with their refrigeration systems, and named Danfoss among its suppliers, Reuters reported via CNBC.

"Everything is destroyed," Engla Ingwall, a sales manager at an ICA franchise store in Stockholm, told Reuters. "There has been a cyberattack and all our freezers reached 50 degrees." She said the attack happened at 2 a.m. but was not noticed until hours later.

Belgium and Luxembourg. Delhaize said an "IT incident" affected refrigeration systems in several dozen of its stores, mostly in Belgium and a few in Luxembourg. Spokesperson Sarah De Meester said the range of fresh and frozen products in the affected stores was temporarily somewhat limited, but that distribution centers were operating normally and deliveries to stores had not been disrupted, according to AP. Carrefour said 15 of its more than 700 Belgian stores were affected and called the impact "extremely limited." Colruyt Group, which runs Spar stores in Belgium under franchise, said five shops were attacked. Ikea said its store in Mons was affected and that it was investigating.

Stephan Moelans, chief executive of the Belgian refrigeration company Sabcobel, which operates Delhaize's systems, told the Belga news agency that the units' evaporators had been switched into defrost mode, NBC News reported. In a defrost cycle, a cooling unit warms up instead of chilling.

Luc De Laet, owner of the Belgian butcher chain De Laet & Van Haver, told Reuters an employee woke him at 3:30 a.m. He found the fridges at his store south of Antwerp turned up as high as 18 degrees Celsius. He estimated the loss at about 15,000 euros ($16,800) worth of meat. "It's very scary. They are hacking the system that is doing the registration of the temperature, and they can program it at a distance," he said.

Ireland. Musgrave Group said refrigeration systems in 13 of its SuperValu stores were affected and that chilled and frozen products were removed from sale as a precaution. "Our monitoring systems alerted us to the issue and we took immediate action," the company said. By Monday afternoon, it said the incident had been resolved and that restocking of chilled and frozen products in the affected stores was under way, according to AP and The Hacker News.

Estonia. A refrigeration technology company told public broadcaster ERR that attackers had accessed a computer controlling a client's refrigeration and raised the temperature to 50 degrees Celsius, AP reported. Jann Mutso, chief executive of Kitman Coldtech, said the attack was handled within minutes and caused no significant damage. The Selver supermarket chain said one of its outlets was affected.

The Netherlands and elsewhere. Ahold Delhaize told NBC News it was aware of an "IT incident" affecting refrigeration systems in a number of stores, and that "our teams are working hard to fully assess the situation." The technology site The Hacker News reported that at least 17 businesses were affected in the Netherlands, along with a few smaller Kesko stores in Finland, seven Intermarché stores in Portugal and at least four Coop stores in Sicily, Italy. Gizmodo, citing the BBC, also listed Finland among the affected countries. NewsCubby has not independently confirmed the Finland, Portugal and Italy cases with the companies involved.

How did the attackers get in?

Modern supermarket refrigeration is run by controllers that technicians can monitor and adjust remotely over the internet. According to Reuters, at least some of the units hit on Monday used technology from Danfoss, which said it had been working with customers to put fixes in place.

In the Netherlands, a Danfoss spokesperson said affected systems were not on a secure network and were still using default passwords, The Hacker News reported. Most Dutch shops had taken measures after the French attack, and the few that had not were the ones hit, the spokesperson said. ICA said all of its affected stores were connected to an outside system supplied by Danfoss, according to the same report. Kitman's chief executive said older controllers that had not been updated were the ones targeted in Estonia.

John Billow, head of Sweden's national cybersecurity center, said his agency was working on several incidents at grocery stores. "We have in recent weeks... identified that we have quite a lot of exposed operational technology devices in Sweden that we have been clear about the necessity to update or patch," he said, according to NBC News.

France's national computer emergency team, CERT-FR, issued an alert on Oct. 12 about attacks on remote controllers for refrigeration systems. The alert covers the Danfoss AK-SM and AK-SC series and the Copeland xweb and Dixell xweb controllers, and was last updated Oct. 16, according to the agency's website. It tells operators to take affected units off the public internet, restrict access to a secure VPN, update firmware, and make sure default passwords have been changed. It also warns that exposing end-of-life devices without security patches carries "a very high probability of compromise," and that attack campaigns are probably still under way. Even after a factory reset, a device remains vulnerable if it is still exposed or unpatched, the alert says.

Patrick Lamplmair, chief technology officer of Austria-based Tributech, told Gizmodo that fixes for known flaws in refrigeration controllers already existed, but that thousands of devices were still reachable from the internet after the French attack. "A freezer should never accept an instruction to heat to 50°C, no matter who sends it," he said.

What happened in France in October?

About 700 of France's roughly 10,000 supermarkets were affected in that attack, Finance Minister Roland Lescure told Parliament on Oct. 13, according to AP. He said there was no risk to the country's food supply, but that the attack "touches the heart of our food security" and was "a wake-up call for everyone." Groupement Mousquetaires said 300 of its Intermarché and Netto stores were affected, and Coopérative U said 80 of its 2,000 stores were. Carrefour and Monoprix were also hit. Coopérative U chief executive Dominique Schelcher called it "an attack on the French food supply chain."

The Paris prosecutor's office opened an investigation through its cybercrime unit, including into spoiled food and reports of fires, AP reported. Danfoss said at the time that most of the affected systems were older products that no longer received software or security updates. It said it had long advised customers to keep systems updated and behind a firewall.

According to Facilities Dive, the French attackers locked units in defrost mode for several hours. Citing Reuters and an analysis by the security firm Sekoia, it said affected units were also found in Spain, Portugal, Poland, Germany and Belgium. Thierry Cotillard, chief executive of Les Mousquetaires, said losses could reach tens of millions of euros across France, The Hacker News reported.

Who is behind it, and what are officials saying?

No one has claimed responsibility for either wave, and Reuters said it could not establish who was behind Monday's attacks or whether they were linked to France. "It is not known who is behind this attack, and it may never be determined," said Katrien Eggers, a spokesperson for Belgium's Centre for Cybersecurity. "All IT systems are potentially vulnerable, and AI can now be used to successfully exploit these weaknesses — especially by sophisticated actors," she said, according to Reuters. Belgium's federal prosecutor opened a criminal investigation, The Hacker News reported.

The European Commission said the incidents show how digital threats are becoming more disruptive. "They are a deliberate attempt to disrupt our food supply chain and undermine consumers' confidence in it — a warning that we must take seriously," EU agriculture commissioner Christophe Hansen said, according to Reuters. "The repeated occurrence of these cyberattacks is deeply concerning."

The attacks have added to concerns among European authorities about "hybrid" threats to infrastructure since Russia's 2022 invasion of Ukraine, Reuters reported. Moscow has repeatedly denied involvement in sabotage or hybrid warfare. Tom Hegel, a researcher at the cybersecurity firm SentinelOne, told Reuters that the lack of any financial demand points to sabotage rather than extortion. "Retail is an easy target because retail chains run enormous estates of refrigeration controllers, building management systems, door access panels and point-of-sale gear," he said. "An attacker who logs into an exposed control panel leaves almost nothing behind... A teenager and an intelligence service would look much the same from the defender's side."

What does it mean for shoppers?

The companies that commented said the problems were limited to a minority of stores and were being fixed. Delhaize said deliveries were not disrupted, and Musgrave said it was restocking chilled and frozen foods in Ireland. Stores removed affected products from sale. No company reported a wider shortage.

For more on cyber threats and security in Europe, read NewsCubby's coverage of Europe's latest unrest, the Binance crypto hack and France's cost-of-living protests.

*Want more? Explore today's headlines on NewsCubby and join My Day free to make NewsCubby part of your day.*

*ARCHIVE PHOTO: Danfoss headquarters in Nordborg, Denmark, May 10, 2008. Reuters reported that some refrigeration units hit on Nov. 2, 2026, used Danfoss technology. Photo: Schnatzel / Wikimedia Commons / public domain.*

*NewsCubby articles are produced with AI assistance and reviewed by humans.*