- Supermarkets in Sweden, Belgium and Luxembourg reported overnight disruptions to refrigerators and freezers, with other incidents reported elsewhere in Europe.
- Some affected systems were reportedly manipulated to raise temperatures to around 50°C, threatening fresh and frozen food stocks.
- The incidents follow a major attack in France in October, but authorities have not established whether the two waves are connected.
Supermarket refrigeration systems across Europe have been targeted in a fresh wave of suspected cyberattacks, raising concerns about food losses and the security of equipment used to preserve essential supplies.
The latest incidents were reported in the early hours of Monday (2), with retailers in Sweden, Belgium and Luxembourg among those affected. Reports also identified incidents in Estonia, Ireland and the Netherlands.
The attacks come just weeks after hackers disrupted refrigeration systems at hundreds of French supermarkets, forcing retailers to discard fresh and frozen food after temperatures inside some units reportedly climbed to 50°C.
In Sweden, supermarket chains ICA and Coop confirmed that a number of stores had experienced problems with their refrigeration and freezer systems. Coop told local media that six stores had been affected, while ICA described the disruption as affecting a limited number of outlets.
Belgian supermarket chain Delhaize, part of the Dutch-Belgian retail group Ahold Delhaize, said an IT incident had affected refrigerators and freezers in dozens of its stores in Belgium and Luxembourg. Company spokesperson Sarah De Meester said temperatures had risen and that the incident was under investigation.
Belgian media also reported disruption at several retailers, including five Spar outlets, Shop & Go convenience stores attached to Q8 service stations and Proxy Delhaize minimarkets.
Why are supermarket refrigeration systems being targeted?
The latest incidents have raised concerns because refrigeration systems are increasingly connected to digital networks, allowing operators and maintenance contractors to monitor and adjust equipment remotely.
That connectivity can also create an entry point for attackers, particularly when older control systems remain exposed or no longer receive security updates.
In Belgium, refrigeration installation company Sabcobel mobilised technicians during the night after receiving reports of problems. Its chief executive Stephan Moelans said around 20 affected refrigeration units had been identified among the hundreds of systems the company manages across the country.
He said the affected units required physical modifications rather than software updates alone.
In Sweden, one supermarket manager described the disruption to broadcaster TV4, saying staff could not change the temperatures and that heat was being blown into the freezers. The store faced the prospect of losing its stock.
Reports from Estonia indicated that an older Danfoss refrigeration system had been accessed, while Dutch broadcaster NOS reported that Copeland equipment had also been targeted in Belgium.
The latest incidents have not yet been attributed to a particular group. No organisation has publicly claimed responsibility, and it remains unclear whether the attacks are connected to the October incidents in France.
What happened in the earlier French supermarket attack?
The October attack affected refrigeration systems at hundreds of French supermarkets, with the Paris prosecutor's office reporting around 700 victims. Retailers including Intermarché, Coopérative U, Carrefour, E.Leclerc and Monoprix were among those affected.
Hackers reportedly manipulated remote refrigeration controllers, changing temperature settings and extending defrost cycles. Some units reached temperatures of more than 50°C, while alarm systems were also disabled in some cases.
The disruption forced stores to discard fresh meat, dairy products and frozen food to avoid health risks. Reported losses varied widely, with some individual stores facing damage worth tens of thousands of euros and others reporting losses exceeding €130,000.
Investigators examined vulnerabilities in equipment supplied by manufacturers including Denmark's Danfoss. Some affected systems were older products that no longer received security updates. Copeland equipment was also reported to have been targeted in France.
The incidents have exposed a wider weakness in the retail sector: equipment that was traditionally treated as operational machinery is now connected to networks and can potentially be accessed remotely.
The European Union's Cyber Resilience Act is due to introduce stricter cybersecurity requirements from December 2027, including expectations around security updates over the anticipated lifetime of products. However, the latest incidents highlight the risks posed by legacy equipment already in use.
For retailers, the immediate challenge is to restore refrigeration systems, assess potential food losses and prevent further disruption. The wider concern is whether supermarkets and equipment providers can secure older connected devices before similar incidents spread further.
Investigations into the latest wave are continuing, with the identity of the attackers and any connection to the French incidents still unknown.
