Hackers manipulate supermarket freezer temperatures across Europe, exposing ...

A new spree of cyberattacks targeting supermarket refrigeration systems has spread across Europe, affecting grocery chains in at least seven countries and forcing retailers to remove chilled and frozen products from sale after hackers manipulated temperature controls.

Incidents were reported on Nov. 2 in Sweden, Belgium, Estonia, Ireland, Finland, Luxembourg and the Netherlands, with affected retailers including ICA, Coop, Ahold Delhaize, Colruyt, Carrefour, Intermarché and SuperValu. IKEA also confirmed that at least one of its Belgium stores was affected. The incidents follow a similar attack in France last month, when hackers reportedly seized control of cooling systems at hundreds of supermarkets, raising temperatures to as high as 50 degrees Celsius and causing fires and significant food losses.

In Sweden, supermarket operator ICA said a limited number of stores experienced an overnight incident affecting refrigeration and freezer systems. An ICA franchise store in Stockholm reported that its freezers had reached 50 degrees Celsius after an attack at 2 a.m., destroying its frozen inventory.

“Everything is destroyed,” Engla Ingwall, sales manager at an ICA franchise store in Stockholm, told Reuters during a visit to the store on Monday, adding the attack occurred at 2 a.m. (0100 GMT) but was only noticed hours later.

“There has been a cyberattack and all our freezers reached 50 degrees (Celsius).”

A spokesperson for privately held ICA said the company ​was aware that a “limited number of stores were affected by an incident overnight, which impacted their refrigeration and freezer systems”.

Coop also reported incidents affecting six stores. In Belgium and Luxembourg, Ahold Delhaize said refrigeration systems in dozens of supermarkets were affected, while Colruyt reported attacks on five stores. Carrefour Belgium reported disruption at 15 of its 700 stores, and Intermarché said 15 stores experienced technical problems. Ireland’s SuperValu confirmed that a specific refrigeration system model in 13 of its 223 stores had been affected, prompting the removal of chilled and frozen products from sale.

“The latest attack on supermarket fridge systems in Belgium comes less than a month after French supermarkets were hit by a similar incident. While supermarket fridges might seem an unusual target, they are connected to wider systems that help stores operate, making them an attractive weak spot for attackers,” James Stanley, head of engineering at WITTENSTEIN High Integrity Systems, wrote in an emailed statement. “Food retailers are part of critical national infrastructure, and attackers know this. Disrupting these systems can cause massive financial damage for stores, and more broadly, create nationwide hysteria at a time of increased focus on national cybersecurity.”

He noted that “this increase in threats across Europe therefore is a stark reminder that we need to think the security of connected products throughout their entire lifespan, not just when the software is first developed. Many embedded systems are designed to run for years, so manufacturers need to consider how they will be kept secure and how vulnerabilities will be dealt with over time. Meanwhile, buyers should ask suppliers the right questions how long products will be supported and how vulnerabilities will be handled.”

Stanley identified that these attacks will increasingly affect both retailers and shoppers until manufacturers take the necessary precautions to prevent them.

“The new EU Cyber Resilience Act recognises these risks and is introducing new requirements,” he added. “Specifically, these requirements focus on ‘ secure-by-design ’ development and effective vulnerability handling throughout a product’s declared support period. While regulation alone won’t prevent attacks like this, it should push security and long-term support further up the agenda when connected products are designed and bought.”

In Estonia, hackers accessed a computer controlling the refrigeration system at one Selver supermarket and raised the freezer temperature to 50 degrees Celsius. Selver said its technology partner detected the attack quickly, preventing damage to the store. The refrigeration equipment provider, Kitman Coldtech, said attackers exploited an older Danfoss refrigeration system and that other Estonian clients may also have been targeted. Incidents have raised concerns the exposure of remotely managed OT (operational technology) across retail environments.

Sweden’s National Cybersecurity Centre said it was investigating the incidents and had identified a significant number of exposed OT devices requiring updates or patches. Authorities have not established who was behind the attacks or whether they were connected to the earlier French incidents.

Ireland’s National Cyber Security Centre (NCSC) said it is aware of reports concerning cyber incidents affecting commercial refrigeration systems used by retailers in Ireland and elsewhere in Europe. “The NCSC has been monitoring developments associated with this activity and remains engaged with relevant national and international cybersecurity partners to better understand the nature and scale of the threat. Current indications suggest the incidents may be related to a known vulnerability,” it said.

It warned that responsibility for the affected systems rests with the relevant operators and their suppliers. “These incidents highlight the importance of maintaining strong cybersecurity measures across operational technology environments,” the agency added.

Unlike traditional cyberattacks focused on stealing data or disrupting IT services, attacks on operational technology can have immediate physical consequences. Compromised refrigeration systems can mean spoiled food, interrupted operations, significant financial losses, and potential risks to food safety.

“These incidents illustrate why cybersecurity is no longer just protecting information. When attackers interfere with operational technology, the consequences become physical,” Michael Ferdinandsen, CEO at Secomea , a Danish industrial cybersecurity company specializing in secure remote access, said in a media statement.

“For retailers, the question isn’t whether they need remote connectivity. They absolutely do. The question is whether they have sufficient control over who can access their equipment, what they can reach, and what they’re allowed to do.”