European supermarket cyberattacks disrupt refrigeration systems in several countries
A wave of cyberattacks has targeted supermarket refrigeration systems across Europe, disrupting food storage and forcing retailers to discard perishable goods. Businesses in Sweden, Belgium, Estonia, Luxembourg, Ireland and the Netherlands have reported incidents involving remotely manipulated temperature controls.
In several cases, hackers changed refrigeration settings to as much as +50°C, turning equipment designed to preserve food into a potential source of substantial financial losses. Reports have suggested that the wider damage could run into millions of euros, although the total has not been established.
The attacks have highlighted vulnerabilities in internet-connected refrigeration equipment, particularly older systems that have not received adequate security updates.
Danish refrigeration technology manufacturer Danfoss, whose equipment is used by some affected businesses, said systems operating with outdated software and insufficient security protections were among those targeted.
Similar incidents occurred in France in October, when attackers reportedly manipulated refrigeration controls at hundreds of stores. Some compromised systems were switched into defrost mode, with reports of temperature settings reaching +80°C.
The latest attacks demonstrate how cybersecurity failures can have immediate physical consequences. Instead of stealing information or demanding ransom, attackers can interfere directly with the equipment on which food retailers depend.
Hackers strike at least 17 Dutch businesses
In the Netherlands, hackers targeted the refrigeration and freezer systems of at least 17 companies overnight, remotely changing their temperature settings.
According to NL Times, citing information from Danfoss, the affected businesses included butchers, small neighbourhood shops and frozen-food storage facilities.
Major Dutch supermarket chains were not known to have been affected by this particular attack, and the names of the smaller businesses involved were not disclosed.
One of the targeted facilities was a frozen-food warehouse, where refrigeration equipment normally maintained at −20°C was reportedly reset to −10°C. The company managed to intervene quickly and restore the correct settings before serious damage occurred.
The method resembled attacks in France several weeks earlier, when compromised refrigeration systems were instructed to begin defrosting, causing temperatures to rise gradually.
Following those incidents, Danfoss advised Dutch customers on 13 October to disconnect vulnerable refrigeration equipment from the internet and reconnect it only through secure networks.
Most businesses followed the advice, but some did not. According to a company representative, those that continued using improperly secured systems became targets of the subsequent attack.
The affected equipment was reportedly accessible through insecure network connections and continued to use default passwords. The incident raises an uncomfortable question: how can commercially critical equipment remain connected to the internet without adequate protection, even after suppliers have issued explicit security warnings?
There had already been another warning sign in October, when hackers attempted to penetrate the digital systems of Dutch supermarket chain Albert Heijn.
The company was forced to shut down parts of its digital infrastructure, disrupting deliveries to stores and making online orders temporarily unavailable. However, no connection between that incident and the refrigeration attacks has been established.
Belgium and Estonia report attacks on major supermarket chains
The wave of cyberattacks also reached Belgium, where refrigeration systems at several major retailers were compromised. Among the affected businesses were Carrefour, Delhaize, Intermarché, Spar and an IKEA location near Mons.
According to Euronews, citing the companies and Belgian authorities, approximately 40 Delhaize Proxy stores, 15 Carrefour Shop & Go locations, 15 Intermarché outlets and five Spar Q8 locations were affected.
Some retailers had to remove chilled and frozen products from sale after their refrigeration systems began malfunctioning. One supermarket reportedly estimated its losses at €60,000, while photographs of empty refrigerated shelves circulated in local media.
Carrefour confirmed that 15 of its approximately 700 Belgian stores were affected but described the overall impact on its operations as limited.
The Belgian Centre for Cybersecurity acknowledged the incidents, and federal prosecutors opened an investigation.
Belgium’s Federal Agency for the Safety of the Food Chain also warned affected retailers that they remained responsible for monitoring refrigeration temperatures and ensuring that potentially spoiled products were not sold.
In Estonia, hackers gained access to a computer controlling the refrigeration system at a Selver supermarket and changed a freezer’s target temperature to +50°C.
As Estonian public broadcaster ERR reported, the attackers compromised an older type of Danfoss refrigeration controller.
“A cyberattack hit a Selver supermarket in Estonia, with hackers accessing a computer controlling refrigeration and changing a freezer setting to 50 degrees above zero.”
Selver confirmed that one of its stores had been targeted but declined to identify the location or disclose details of its technical infrastructure for security reasons. The company’s technical partner detected the intrusion quickly. According to refrigeration technology supplier Kitman Coldtech, the incident was addressed within approximately ten minutes.
Although the target temperature was set to +50°C, the actual temperature inside the affected equipment increased by only two to three degrees before normal operation was restored. Selver reported no damage to its products. The supplier said the attack appeared to exploit vulnerabilities in older refrigeration systems that had not yet been upgraded.
Similar incidents have also been reported in Sweden and Luxembourg, where supermarket operators experienced disruptions to refrigerated storage.
Food losses expose a new vulnerability in Europe’s retail sector
The consequences have been particularly visible in Sweden, where stores belonging to ICA and Coop reported refrigeration problems.
At some locations, freezer settings were changed to +50°C, forcing staff to remove or discard affected products. Photographs and accounts of damaged stock illustrated how quickly a digital intrusion can become a commercial disaster.
In Ireland, refrigeration incidents affected stores belonging to the SuperValu chain, prompting the precautionary removal of chilled and frozen food from sale.
These attacks are especially damaging because perishable goods cannot simply be restored from a backup once they have spoiled. Even a relatively short interruption to refrigeration can require large quantities of food to be discarded.
For smaller retailers, such as butchers and neighbourhood grocery shops, the financial consequences can be particularly serious.
The incidents also reveal the risks created when essential physical infrastructure depends on remotely accessible digital controls.
Internet-connected equipment can improve efficiency and allow technicians to monitor temperatures without visiting each location. But outdated software, default passwords and poorly secured connections can also provide attackers with opportunities to manipulate machinery from a distance.
The identities of those responsible for the incidents remain unclear, and the available reports do not establish that all the attacks across Europe were carried out by the same individuals or group.
What is already evident is the scale of the vulnerability. Refrigeration systems that once operated largely independently are now part of interconnected networks, where a cybersecurity failure can mean lost stock, disrupted deliveries and substantial financial damage.
For European retailers, protecting digital infrastructure is no longer simply a matter of keeping customer data secure. It is increasingly a question of whether their equipment can continue doing its most basic job: keeping food cold.
