New wave of cyberattacks targets European supermarket freezers

Cyberattacks on refrigeration systems have disrupted supermarkets across Belgium and Sweden, forcing some stores to discard fresh and frozen food after their cooling systems failed to maintain safe temperatures.

Store managers and a refrigeration contractor described remotely altered settings.

The problems emerged overnight on November 1–2, weeks after similar attacks hit hundreds of French supermarkets. Belgian broadcaster RTL Info reported affected stores belonging to Delhaize, Carrefour, Intermarché, and Spar, while Swedish reporting identified ICA and Coop locations.

In Belgium, approximately 40 Delhaize stores, 15 Carrefour stores, around 15 Intermarché stores, and five independently operated Spar Colruyt outlets were affected, according to RTL . Delhaize described the disruption as an IT incident, while Carrefour said it was assessing the situation.

ICA and Coop are major Swedish grocery retailers, with approximately 1,300 and 800 stores, respectively. The reported refrigeration failures affect a small subset of their networks.

ICA spokesperson Gustaf Nilsson told Swedish news agency TT that an overnight incident had affected refrigeration and freezer systems at a limited number of stores and that the company was supporting them. Coop press chief Carlos Cancino confirmed problems at six stores in central Sweden, without initially confirming whether food had been discarded.

At ICA Kvantum in Sjöbo, manager Rickard Nilsson told TV4 that freezer settings had been changed to +50°C and staff could not restore them. He suspected a cyberattack and said food worth hundreds of thousands of Swedish kronor had been ruined. The reported setting does not establish that all affected cabinets physically reached that temperature.

Belgian butcher chain De Laet & Van Haver also reported refrigeration disruption, with staff intervening after settings were altered to activate defrosting.

Refrigeration contractor Sabcobel’s director, Stephan Moelans, told Belga, as reported by RTL , that technicians worked overnight disconnecting affected installations. He described attackers remotely activating defrost functions, which normally remove ice from cooling equipment.

The manufacturer, controller models, and initial access method involved in the latest incidents remain unknown.

The events resemble October’s French refrigeration attacks. France’s CERT-F R confirmed compromises involving Danfoss AK-SM and AK-SC controllers and Copeland/Dixell XWEB systems.

Refrigeration operators are advised to remove direct internet access to management interfaces, restrict remote access through a secure VPN or protected network, update supported firmware, and change default access passwords. Operators should also inspect defrost schedules and other settings.