A supermarket freezer cyberattack remotely raised refrigeration temperatures as high as 50C (122F) overnight at stores in at least seven European countries, forcing some retailers to discard stock. Chains in Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia and Finland reported faults on Monday, echoing an October attack on hundreds of French supermarkets. No group has claimed responsibility.
Key Takeaways
- Freezers in seven European countries were remotely warmed to as high as 50C.
- Evaporators were switched to defrost mode, a method believed to match France.
- Thousands of controllers stayed internet-reachable after the French incident.
- No group has claimed responsibility or made a financial demand.
How the Supermarket Freezer Cyberattack Worked
Attackers switched evaporators to defrost mode, Stephan Moelans, chief executive of Belgian firm Sabcobel, which operates Delhaize’s systems, told the Belga news agency. BBC News said that method is believed to be the same as last month’s incident in France. The company had been “working all night and morning to disconnect the affected units from the network”, he said, and he told Le Soir: “We started mobilising technicians at 1am.”
BBC News reported freezers in several shops reached 50C. An ICA store in Sjöbo wrote that “Our refrigerators and freezers have been hacked overnight and they have set the temperature to 50 degrees.” A Hoeilaart Delhaize branch lost €100,000 (£83,500) of produce, before closure costs, Het Laatste Nieuws reported. Not every site saw that scale of loss.
Which Chains Lost Refrigeration
BBC News reported around 40 Delhaize supermarkets in Belgium and Luxembourg. Ahold Delhaize described an IT incident in dozens of those stores. Sarah De Meester said fresh and frozen ranges were “temporarily somewhat limited”, but distribution centres operated normally. After about 15 of 700 Belgian shops were disrupted, Carrefour spokesperson Mich Vergauwen said: “It’s a cyber-attack, there is no other reason.”
| Retailer or operator | Where reported | Scale cited |
|---|---|---|
| Delhaize / Ahold Delhaize | Belgium, Luxembourg | Around 40 stores |
| Carrefour | Belgium | About 15 of 700 shops |
| Colruyt (Spar franchise) | Belgium | Five shops |
| Intermarché | Belgium | 15 shops |
| Coop | Sweden | Seven of 800 stores |
| SuperValu (Musgrave) | Ireland | 13 of 223 shops |
| Dutch companies | Netherlands | At least 17 companies |
IKEA said freezers at its Mons store were affected and “we cannot rule out that additional locations may be affected.” ICA reported a small number of stores outside its central network. Coop told the BBC seven of 800 Swedish stores were affected but the “situation is currently contained and under control.” Musgrave said a specific model in 13 of 223 SuperValu shops was affected.
A Danfoss spokesperson told NOS that systems of at least 17 Dutch companies were attacked overnight. Kesko is investigating refrigerator problems at Finnish K-stores. A Selver outlet in Estonia was also affected. Colruyt said five Belgian shops were attacked, and The Guardian reported technical problems at 15 Intermarché shops.
Belgium and Sweden’s national cyber-security agencies said they were monitoring. The UK’s National Cyber Security Centre said it was working to “fully understand details of an incident”; no incidents have been reported in the UK.
Danfoss Controllers Still Exposed After France
The method is believed to be the same as early October in France, when hackers seized cooling units at as many as 700 supermarkets, causing fires and losses estimated in the tens of millions of euros, The Guardian reported. Cabinets at Intermarché, Coopérative U, Carrefour, Leclerc and Monoprix were driven from as low as -27C to well over 50C. Prime Minister Sébastien Lecornu instructed France’s cybersecurity agency, Ansii, to investigate, and the Paris prosecutor opened a formal investigation. Ansii later found controllers from two other companies were also targeted.
Controllers in France were mostly from Danfoss, which had identified flaws last year and had “long recommended” updates. CNBC reported that at least some Monday units also used Danfoss technology, and that the firm was working with customers to implement fixes.
Moelans said efforts to “protect our customers fridges against this vulnerability” still required physical modifications, not software alone. “The simplest solution is to manage the fridges over a secure internet connection. Most of our customers switched to that after the attack in France,” he said.
The Guardian reported that Patrick Lamplmair of the cybersecurity firm Tributech said: “Thousands of these controllers were still reachable from the internet after the French attack.”
What IT Teams Should Change Now
John Billow, head of Sweden’s national cybersecurity centre, told Reuters the country had “quite a lot of exposed operational technology devices” that needed updating or patching. EU agriculture commissioner Christophe Hansen called the attacks “a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it”. Tom Hegel of SentinelOne said the lack of financial demands points to sabotage.
Reuters could not establish who was behind Monday’s attacks. Moscow has repeatedly denied involvement in sabotage or hybrid warfare operations, CNBC reported. US authorities are investigating August refrigeration malfunctions at military bases and any possible French link, the BBC reported.
For facilities and security leaders, the reading is an operational-technology exposure problem, not a conventional data breach.
- Disconnect affected controllers, as Sabcobel did through the night and morning after mobilising at 1 a.m.
- Move management onto a secure connection; some units still need physical changes.
- Inventory controllers that stayed reachable after France and segment them.
- Alert on unexpected setpoint changes and rehearse safe disposal of stock.
