European grocery chains' freezers, refrigerators targeted in apparent cyberattacks

Refrigerators and freezers at grocery stores in Belgium, Sweden, Ireland, The Netherlands, and Estonia malfunctioned after apparent cyberattacks. The attacks changed temperature settings or other operating functions. Food spoiled because chilled and frozen products were no longer kept at safe temperatures. The affected locations represented only a limited share of each chain’s stores.

One Swedish ICA store in Sjöbo reported that its refrigerators and freezers had been hacked and set to 50 degrees Celsius. Sweden’s Coop said seven of more than 800 stores were affected. Carrefour reported problems at 15 of its 700 stores in Belgium. The article also describes incidents involving Delhaize, SuperValu stores, and Danfoss refrigeration systems.

The incidents were described as contained or limited by some companies, and stores generally remained open. However, they show that connected equipment can disrupt food storage without taking an entire retail network offline. Similar attacks had affected hundreds of French grocery stores the previous month and several U.S. military commissaries in August.

A cyberattack on a refrigeration system means unauthorized digital interference with the equipment or software controlling cooling. The attacker changes settings, schedules, or operating functions through a connected control system. The article reports that these attacks altered refrigerator and freezer settings and caused food spoilage. It does not identify the attackers.

The clearest example came from Sweden, where an ICA store said its refrigerators and freezers were hacked overnight and set to 50 degrees Celsius. Coop also reported an incident affecting seven stores. In France, hundreds of stores reportedly experienced similar attacks, with temperatures set to the same level. These examples show the key mechanism: digital commands changed the equipment’s intended operation.

The current incidents were reported in Belgium, Sweden, Ireland, The Netherlands, and Estonia. Companies described the impact as limited, and Coop said its situation was contained and under control. Still, the attacks matter because a small change in a control system can damage products across multiple stores without a conventional break-in.

The article gives several specific counts, but not one complete total. Coop reported seven affected stores out of more than 800. Carrefour reported 15 affected stores out of 700. Musgrave said 13 SuperValu stores were affected. Danfoss said 17 facilities using its systems were hit. Those figures alone add to 52 counted stores or facilities, though they cover different companies and types of sites.

Other affected companies did not provide exact totals. ICA described a small number of stores outside its central network. Delhaize confirmed an IT incident without stating how many locations were involved. The article also mentions problems in Estonia but does not name an affected company or give a count there.

The incidents therefore affected only a small fraction of the named large chains, based on the figures provided. Carrefour said all stores remained open because only a few refrigeration units were affected. Coop called its situation contained and under control, while the wider pattern extended across several countries and refrigeration providers.

Refrigeration protects food by keeping it cold enough to slow spoilage and preserve frozen products. If a cyberattack raises the temperature or disrupts cooling, that protection weakens. Food can warm, lose its frozen state, and become unsuitable for sale. The article directly links the altered settings and malfunctioning units to food spoilage.

In Sweden, one ICA store reported that its refrigerators and freezers were hacked and set to 50 degrees Celsius. The same temperature was reportedly used in attacks on hundreds of French grocery stores the previous month. At that level, the affected equipment was no longer maintaining normal cold storage. Carrefour said its affected stores stayed open because only a few refrigeration units were involved, but spoiled products still posed a loss.

The precise speed and extent of spoilage depend on the food, equipment, and time exposed. The article does not give those details. It does show the operational risk: changing digital settings can damage inventory even when buildings, checkout systems, and most store operations continue working.

Affected companies included Swedish chains ICA and Coop, Belgian chains Delhaize and Carrefour, Irish chain SuperValu, and Dutch refrigeration provider Danfoss. The incidents were reported in Belgium, Sweden, Ireland, The Netherlands, and Estonia. The article also describes similar earlier attacks in France and at U.S. military commissaries. It does not name an affected Estonian company.

Coop said seven stores were affected, while Carrefour reported 15. Musgrave, which owns SuperValu, said 13 stores using a specific refrigeration model were hit. Danfoss said 17 facilities using its systems were affected. ICA described a small number of stores operating outside ICA’s central network. These details connect the incidents to particular equipment, sites, and network arrangements.

The targets appeared to be smaller stores, and only a limited number of locations in each chain were affected. The article does not establish why those sites were selected or prove that being outside a central network caused greater vulnerability. It does show that decentralized or separately operating locations were relevant to the pattern under investigation.

Refrigeration systems often depend on software that controls temperatures, sensors, alarms, and connected equipment. Outdated software may no longer receive security fixes or may contain weaknesses that attackers can exploit. The article reports that most systems targeted in France were reportedly using outdated software. It does not identify a specific flaw or explain exactly how access was gained.

Coop said its incident occurred ahead of a planned system upgrade. The upgrade had been in the works because of a similar problem affecting French grocery stores the previous month. Hundreds of French stores reportedly saw refrigerators and freezers hacked, with temperatures set to 50 degrees Celsius. This links the planned upgrade to a response to an earlier attack, not necessarily to a confirmed cause of the new incident.

Keeping software updated can reduce known security risks, but an upgrade must also be managed carefully so equipment remains operational. The article provides no technical details about the planned upgrade’s design or completion. It does show why aging systems and delayed modernization became important concerns for affected grocery companies.

A refrigeration control system generally uses temperature sensors, a controller, and cooling equipment to maintain a chosen setting. The controller checks conditions and signals components such as compressors or fans to cool the space. Connected systems may also send alerts or allow remote adjustments. The article does not explain this machinery, so these operating details come from established refrigeration knowledge.

The incidents show what happens when digital control is misused. Attackers altered settings and functioning, and one ICA store reported temperatures set to 50 degrees Celsius. Coop and Carrefour also reported affected stores, while Danfoss identified 17 facilities using its systems. The altered controls allowed storage conditions to move away from normal refrigeration.

Grocery stores rely on these systems because refrigerators and freezers continuously protect perishable and frozen inventory. If they malfunction, food can spoil, as companies reported here. The article shows that the risk extends beyond individual appliances: connected equipment can affect multiple retail locations. It also highlights the need to address software and network security alongside physical maintenance.