Supermarket freezers across Europe struck in second crippling cyberattack

Supermarket refrigeration systems were disrupted in Belgium and Sweden, then reports added Ireland, Estonia, and the Netherlands. France had suffered a similar attack weeks earlier. The incident matters because internet-connected equipment can turn a digital intrusion into spoiled physical goods and major losses.

In Belgium, refrigeration fitter Sabcobel estimated that at least twenty units were affected. Delhaize, Carrefour, and Spar were named among the affected chains. In Sweden, several ICA and Coop stores reported disturbances, and photographs showed employees throwing away carts of food. The hackers used the same reported method as in France: remotely activating built-in defrost mode.

The article does not give a total number of damaged units across Europe or a precise food-loss estimate. It says the affected items likely represented millions of dollars of stock. Sabcobel said physical changes are needed to remove the vulnerability, while moving units to a secure internet connection was described as the simplest temporary measure.

An internet-connected refrigeration unit can send data and receive commands through a network. A cyberattack occurs when an unauthorised person exploits a weakness in that connection or the unit’s software. The danger is not limited to stolen information. If attackers can change operating settings, they can physically affect temperature, food, and equipment.

The article describes hackers remotely activating a freezer’s built-in defrost mode. They reportedly overrode the normal temperature setting and the length of the defrost cycle. In Belgium, Sabcobel estimated that at least twenty units were affected. In Sweden, ICA and Coop stores reported similar disturbances, while staff discarded goods from affected stores.

This incident shows why connected operational equipment needs stronger protection than ordinary convenience features. The article says physical modifications are required to address the vulnerability. It also reports that most customers moved units to secure internet connections after the earlier French attack, but similar disruptions followed in other countries.

Six countries are mentioned in connection with these incidents: France, Belgium, Sweden, Ireland, Estonia, and the Netherlands. The article names five supermarket chains or retail brands in the reports: Delhaize, Carrefour, Spar, ICA, and Coop. It also refers to supermarkets owned by Dutch company Ahold Delhaize, which is an owner rather than an additional named store chain in that count.

The only specific equipment figure is Sabcobel’s estimate that at least twenty refrigeration units were affected across Belgium. The article gives no combined number for Belgium, Sweden, Ireland, Estonia, the Netherlands, and France. It also does not provide a precise quantity of discarded food or a confirmed financial total.

The reported financial scale is described rather than measured. The article says the freezer contents were likely destroyed, representing millions of dollars worth of items. That wording indicates potential losses, not a verified final bill. The reports from Ireland, Estonia, and the Netherlands were emerging in the article’s update.

The article describes the attack as misuse of a freezer’s connected control system. Because the units could be controlled remotely, hackers were reportedly able to send commands over the network. The article does not explain the software flaw or identify the attackers, but it says the same vulnerability and method were involved in the earlier French incident.

The key command activated the freezer’s built-in defrost mode. According to the report, the attackers overrode both the temperature setting and the time spent defrosting. The result was a rapid rise in temperature, reportedly reaching 50 degrees Celsius, which defrosted the contents and likely destroyed the food.

This is an example of a digital command producing direct physical consequences. The article says the vulnerability cannot be fully addressed through settings alone because physical modifications to the units are required. Until then, the company described switching equipment to a secure internet connection as the simplest solution.

A vulnerability can remain exploitable when a temporary protective measure does not change the equipment’s underlying design. The article says the refrigeration company had worked hard to protect its units, but physical modifications were still required. That suggests the original weakness was not fully removed before another attack occurred.

After the French incident, most customers reportedly switched their units to a secure internet connection. However, the article describes this as the simplest solution in the meantime, not a permanent repair. In the later incident, hackers used the same method: remotely activating built-in defrost mode and overriding temperature and timing controls.

The article does not identify exactly which stores failed to apply the recommended protection, nor does it explain the technical vulnerability in detail. It does show that connected equipment remained exposed across multiple markets. The repeat attack underlines the need to complete physical fixes and secure remote access, rather than relying only on quick network changes.

Monitoring does not require every refrigeration control to be directly exposed to the public internet. A safer design separates measurement from command functions. Temperature and fault data can travel outward, while control commands stay on a protected local network or require tightly restricted approval. This reduces the chance that a stolen credential or software flaw can change freezer settings.

Practical alternatives include a local network with no direct internet route, a segmented network behind a firewall, or a VPN and secure gateway for authorised technicians. Supermarkets could also make cloud connections read-only for ordinary monitoring, sending alerts without allowing remote defrost commands. These are established cybersecurity approaches; the article itself specifically mentions secure internet connections and physical modifications.

No design is risk-free, and the article does not say which alternative each supermarket uses. The immediate priority is preventing remote commands from reaching safety-critical controls. Longer term, physical changes to the refrigeration units may be necessary, because the company said connection changes were only the simplest interim solution.

The Internet of Things, or IoT, is the broad network of physical devices that collect data or receive commands online. Operational technology, or OT, is the hardware and software used to monitor or control physical processes. A connected supermarket freezer can involve both: it reports operating data and can receive commands that affect refrigeration.

That connection creates a bridge from cyberspace to the physical world. In the reported incident, hackers remotely activated built-in defrost mode and overrode the freezer’s temperature and timing controls. The units reportedly reached 50 degrees Celsius, rapidly defrosting food. Belgium’s refrigeration fitter Sabcobel estimated that at least twenty units were affected there.

The article presents this as part of a wider dependence on internet connectivity in basic infrastructure. It says physical modifications are required for the refrigeration vulnerability, while secure internet connections were used as an interim measure. The lesson is that OT needs strong isolation, restricted commands, and safeguards against digital instructions causing physical damage.