Fresh wave of fridge cyberattacks hits European supermarkets

Supermarket cooling systems abruptly stopped keeping food cold across Belgium, Luxembourg, Sweden, Finland and Estonia. Several retailers said fridges or freezers showed unusual temperature increases overnight. The incidents threatened food stocks, disrupted store operations and raised concerns about attacks on Europe’s food supply.

In Belgium, Ahold Delhaize and Colruyt reported attacks, while Carrefour said about 15 stores were disrupted. An Ikea store in Mons was also affected. In Sweden, ICA and Coop reported incidents, including one freezer system reportedly set to 50°C. Finnish stores detected irregular temperatures, and at least one Estonian supermarket was attacked.

The full number of affected stores is unclear. Some retailers reported dozens, six or five stores, while others described limited or isolated cases. Authorities and companies were investigating. European Agriculture and Food Commissioner Christophe Hansen said food security was not currently at risk, but food waste and business damage were real.

A cyberattack on a refrigeration unit means an attacker interferes with the digital controls that monitor or operate cooling equipment. If those controls are connected to a store network or remote service, hackers may be able to alter settings without entering the building. That can turn a routine temperature-control problem into a large food-safety and business crisis.

The Belgian refrigeration company Sabcobel operates Delhaize’s systems. Its CEO, Stephan Moelans, said the units’ evaporators were switched to defrost mode during the incident. Evaporators are part of the cooling process, so changing their operating state can stop normal refrigeration. Swedish stores also reported temperatures rising sharply, including one store that said its systems were set to 50°C.

The precise access method has not been publicly established. Companies and authorities were investigating, and Finland had not ruled out network interference. The article says operational technology devices in Sweden were exposed and needed updating or patching.

The incidents were reported in five countries: Belgium, Luxembourg, Finland, Estonia and Sweden. Seven named retail groups or chains were associated with affected locations: Ahold Delhaize, Colruyt, Carrefour Belgium, Ikea Belgium, ICA, Coop and Kesko. The article does not provide one complete store total, because several reports use terms such as “dozens,” “a limited number” or “a few.”

Specific figures include about 15 Carrefour Belgium stores, five Colruyt Group shops, six Coop stores and one Ikea store. The article also mentions at least one Estonian supermarket. Those figures add up to at least 28 specifically identified locations, but this is not the overall total. Ahold Delhaize reported dozens of stores in Belgium and Luxembourg, while ICA and Kesko gave less precise descriptions.

The scale therefore remains partly uncertain. More stores may be included in the unspecified groups, and some retailers may overlap with broader reports. Investigations by companies, police and national cybersecurity authorities were still underway.

A refrigeration system keeps food cold by continuously removing heat. During defrost mode, the evaporator is not operating in its ordinary cooling state. If attackers force many units into that mode, the system can stop removing heat from storage areas. Internal temperatures then climb, especially when doors open or warm air enters.

Sabcobel CEO Stephan Moelans said Delhaize’s evaporators were switched to defrost mode. The article does not describe every technical step after that change, but it links the setting to the temperature increases observed in Belgian stores. In France, police said hackers raised supermarket cooling temperatures as high as 50°C. Those attacks caused food losses and fires.

Spoilage becomes likely when food remains too warm, creating direct costs and waste. Fires add a separate danger to staff, buildings and stock. The article does not establish that defrost mode itself caused every French fire, so the exact fire mechanism remains unconfirmed. It does show that manipulating cooling systems can produce serious consequences.

The current incidents are connected to an attack in France the previous month. Police said hackers seized control of cooling units at hundreds of French supermarkets. They raised temperatures as high as 50°C, causing food losses and fires. That earlier episode established a troubling pattern involving systems that were once mainly mechanical but are now digitally controlled.

The newer wave showed similar signs. Stores in Belgium, Luxembourg, Sweden, Finland and Estonia reported abrupt temperature increases. In Belgium, a refrigeration executive said evaporators were switched into defrost mode. A Swedish ICA store said its refrigeration had been “hacked” and set to 50°C. Finnish officials also did not rule out network interference.

Authorities had not identified the attackers, and nobody had claimed responsibility for either set of incidents. Finland’s cybersecurity authorities said similar events had been seen in Europe in recent months, making spread beyond France expected. Investigations continued while officials assessed food waste, business disruption and wider food-supply risks.

Operational technology, or OT, refers to technology that monitors or controls physical equipment. Supermarket refrigeration fits that description because digital systems can observe temperatures and operate cooling units. The consequences are physical, not merely digital: food can warm, stores can close, and equipment or buildings can be damaged.

The article says refrigeration, heating, cameras and alarm networks can now be monitored and controlled remotely. That connectivity creates opportunities for cybercriminals. Sweden’s cybersecurity chief, John Billow, said officials had identified many exposed OT devices and had stressed the need to update or patch them. An exposed device may provide an attacker with a route to control equipment.

The article does not identify a specific vulnerability or explain exactly how the attackers entered. It does show why maintenance matters. Unpatched systems can remain reachable and exploitable, while remote control expands the possible attack surface. Retailers and authorities were investigating the incidents and considering the wider risks to food operations.

A typical supermarket refrigeration system removes heat rather than simply producing cold. A circulating refrigerant absorbs heat inside a cabinet or cold room through the evaporator. The system then moves that heat outside the refrigerated space, allowing the interior to remain cold. Fans and controls help distribute air and maintain the selected temperature.

In the standard cycle, a compressor raises the refrigerant’s pressure. A condenser releases absorbed heat to the surrounding environment. An expansion device lowers the refrigerant’s pressure before it returns to the evaporator, where it can absorb heat again. Defrost mode temporarily changes the evaporator’s normal operation so accumulated ice can be removed.

The article specifically mentions evaporators being switched to defrost mode, but it does not explain the full refrigeration cycle. This technical description uses established refrigeration knowledge. The reported attacks mattered because changing digital controls could interfere with physical cooling, leading to warming, food loss and potentially dangerous incidents.