Hackers remotely manipulated supermarket refrigerators across Belgium, Sweden, Luxembourg, Ireland and Estonia overnight, forcing chains including Carrefour and Delhaize to destroy tonnes of spoiled food.
The cyberattack struck between the night of November 1 and November 2, altering digital temperature settings and turning cooling systems into heaters. In one Swedish store, controllers were set to 50 degrees, ruining entire stocks of chilled and frozen groceries before staff arrived in the morning.
The incident marks the second major wave of supermarket refrigeration breaches in Europe within a month. France suffered an almost identical disruption three weeks earlier, bringing the total number of affected European nations to six. Retailers caught in the latest attacks include Carrefour, Delhaize, Spar, ICA, Coop, SuperValu and Selver.
Supermarket disruption in Belgium and Sweden
In Belgium, the cyberattack disrupted refrigeration at around 40 Delhaize supermarkets, 15 Carrefour locations and several Spar stores. Delhaize, which described the event as an IT incident, alerted store managers during the early morning after monitoring software detected abnormal temperature spikes, forcing staff to pull affected items from display cases.
Carrefour stated that the disruption across its Belgian network was very limited. The company operates more than 700 stores in the country, but only 15 experienced minor alterations, mainly involving frozen food units. Carrefour confirmed that no hypermarkets were affected and that all of its locations remained open after containment measures were introduced.
Supermarkets across Sweden suffered serious inventory losses, although retail giant ICA said the issue affected a limited number of its branches without providing an exact figure. The Swedish cooperative chain Coop also reported temperature problems at approximately seven stores.
One of the most severe incidents occurred in the southern Swedish town of Sjöbo. Rickard Nilsson, the manager of an ICA Kvantum store there, discovered that the refrigeration controls had been adjusted remotely to 50 degrees. Nilsson said staff were unable to adjust the temperatures and everything was destroyed, estimating losses between 26,000 euros and 43,000 euros.
Food safety regulations require both fresh and frozen groceries to be discarded once the cold chain is broken, even if cooling machinery is later repaired. Workers at other affected Swedish stores also had to clear shelves and throw away spoiled food.
Affected stores in Ireland, Luxembourg and Estonia
In Ireland, 13 SuperValu supermarkets had to remove fresh and frozen goods after parent company Musgrave detected an IT incident. The stores remained open to customers while the company launched an investigation into a specific model of refrigeration equipment used across the locations.
Delhaize also reported refrigeration failures at its supermarkets in Luxembourg. In Estonia, attackers gained access to a computer controlling the cooling systems at a Selver store and altered the programmed temperature to 50 degrees. Maintenance technicians detected the change within ten minutes and restored normal operations shortly after, preventing any food from spoiling.
Defrost cycles used to overheat cooling units
The attacks exploited internet-connected systems that commercial supermarkets use to monitor internal temperatures and adjust settings remotely without having to send technicians to individual branches.
Rather than turning the refrigeration equipment off, the intruders activated the built-in defrost function. Commercial cooling units regularly use this mode to melt frost that builds up on internal cooling coils during normal operation, using electric heating elements to clear the ice.
By leaving the defrost function activated, the attackers caused temperatures to climb high enough to ruin stored food. The method allowed the saboteurs to turn fridges into heaters using existing features that normally present no danger, without needing to shut down the machinery entirely.
In Belgium, refrigeration specialist Sabcobel detected approximately 20 compromised installations. The company mobilized technicians during the night to disconnect affected equipment from the internet and restore manual control.
Stephan Moelans, the director of Sabcobel, said his company had spent weeks working to protect client systems following the French cyberattacks, but some installations remained vulnerable. Moelans explained that simple software updates are not enough to secure certain systems, which require physical alterations or more secure network connections to prevent remote tampering.
Earlier cyberattack on French supermarkets
The latest breaches follow an earlier wave of attacks that hit French food retailers between October 11 and October 12. French Industry Minister Roland Lescure reported that around 700 supermarkets were affected, while other assessments indicated that more than 350 stores suffered direct system breaches.
The financial damage across France was substantial. A single supermarket in Wasselonne recorded losses of 220,000 euros, while a senior manager at supermarket chain Intermarché estimated that the affected stores collectively lost tens of millions of euros in ruined stock and repairs.
French investigators discovered that affected stores were using Danfoss control units that had lacked technical support since 2021, as well as Dixell and Copeland control consoles exposed directly to the internet. Authorities have not confirmed whether equipment from these manufacturers was involved in the November incidents.
Security flaws and unsupported industrial software
Vincent Strubel, the director of French national cybersecurity agency ANSSI, addressed the French Senate on October 21 regarding the supermarket breaches. Strubel pointed to elementary security flaws across commercial retail networks, citing direct internet connections and weak passwords that allowed intruders inside without needing advanced exploit techniques.
Strubel also acknowledged that ANSSI has no legal authority to compel private supermarkets to fix security vulnerabilities. The agency can issue warnings and suggest technical safeguards, but it cannot force commercial operators to implement them.
Similar vulnerabilities exist across other European countries. In October, Swedish public broadcaster SVT identified 3,809 industrial systems operating with public IP addresses in Sweden, of which more than 2,000 lacked proper security protections. Although not all were cooling systems, the audit revealed how many industrial installations remain accessible over the public internet.
Pentagon inquiry into US military commissaries
The disruptions in Europe follow an investigation by the United States Department of Defense into similar incidents on American military installations. Reuters reported on October 29 that the Pentagon is investigating suspected tampering with refrigeration units at grocery commissaries across at least six military bases, with inquiries beginning on August 26.
US officials who spoke to Reuters on condition of anonymity did not state whether the commissary incidents were part of a coordinated campaign. European authorities have issued no official attribution for the supermarket attacks, and no public evidence connects the disruption to any foreign government.
No criminal group has claimed responsibility or demanded a ransom payment for the European intrusions. Investigators have also been unable to determine whether the incidents in France, Belgium and Sweden were carried out by the same perpetrators.
Supermarket operators also face uncertainty over financial recovery. Standard cybersecurity insurance policies might not cover food spoilage, depending on policy terms and whether insurers classify temperature tampering as digital disruption or physical property damage.
Technicians continue working across Belgium and neighboring countries to isolate vulnerable refrigeration controls from the internet, while retailers assess the financial damage and review security on their connected equipment.
