Supermarket fridges are being hacked across Europe – are Tesco and Sainsbury's next?

Want to bookmark your favourite articles and stories to read or reference later? Start your Independent Membership today.

Already a member? Log in

Y ou would have thought there were easier ways to prove your computer hacking prowess than remotely turning off a freezer and defrosting some peas.

And yet, less than a month after hackers managed precisely that in France , supermarket fridges and freezers across Europe have been hit by a fresh wave of cyber attacks .

On Monday, shops in Belgium, Sweden, Luxembourg and Ireland woke to spoiled food , empty refrigerated shelves and the expensive reality of having to throw away perfectly good groceries. Similar problems were reported in Estonia .

At one ICA supermarket in southwestern Sweden , staff said their freezers had been hacked and the temperature set to 50C. Around 40 Delhaize stores in Belgium and Luxembourg were affected, along with 15 Carrefour shops in Belgium and 13 SuperValu stores in Ireland. One Belgian supermarket estimated it had lost €100,000 in the attack.

Nobody has established who is responsible, or whether the latest incidents are connected to what happened in France. The similarities, however, are difficult to ignore.

In October, a cyber attack hit hundreds of French supermarkets, sending temperatures in their fridges and freezers soaring. At around 150 Intermarché stores, temperatures reached 50C for six hours overnight. Food was thrown away, fires were reported, and the morning shoppers found the chilled aisle closed for business . The reported losses from the attack are estimated to run into the millions.

Many of the affected refrigeration systems used controllers supplied by Danish manufacturer Danfoss. The company said most of the affected equipment was either running outdated software or consisted of older systems. It said it had “long advised” businesses to update their systems for this very reason.

Britain has been spared, for now, but Danfoss also supplies refrigeration equipment to Tesco and Sainsbury’s. Neither supermarket has reported being affected – yet – and there is no evidence that their equipment suffers from the same vulnerabilities. Still, the connection has been enough to get Britain’s cyber security chiefs involved.

The National Cyber Security Centre (NCSC), part of GCHQ , has been working with British retailers and its international partners to assess the threat, with advice issued to businesses patching potential vulnerabilities. The British Retail Consortium has also been in with supermarkets. It said retailers were investing heavily in cyber security and working with the NCSC to protect their refrigeration systems.

Remote monitoring sounds convenient for supermarkets… right up until the point when someone figures out how to hack it.

The first time around, it was tempting to dismiss this as an unusually French farce. Sacre bleu, how dreadful, pass the brie. But with supermarkets across Europe now emptying their freezers and Britain’s cyber security chiefs getting involved, the joke is wearing thin. Particularly when the food we buy in the UK depends on networks of computers a lot more than most of us probably realise.

The journey from field to fork doesn’t just involve lorries: there are systems to tell farmers when to water crops, factories what to produce, warehouses where to store it and the aforementioned lorries where to take it. Supermarkets use software to keep track of stock, how to price it, and predict what we want for dinner.

Keeping that all running is one massive job. Keeping it secure is another one entirely.

Britain has already had a taste of what happens when the technology goes wrong. In November 2024, a hit on supply chain software company Blue Yonder caused all sorts of problems for Morrisons , which uses its services for forecasting, replenishing and managing stock. A ransomware attack – where criminals essentially “lock” systems and typically demand payment to release them – disrupted the tech the supermarket uses for managing its fresh and chilled food. Staff had to resort to doing it the old-fashioned way, but still there were gaps on the shelves. The supermarket said it also ran into problems with stock accuracy, availability and waste. After all, it’s difficult to sell what you cannot find in the stockroom.

The following year, another expensive reminder of the fallibility of these systems arrived. In April 2025, Marks & Spencer was hit by a cyber attack that took parts of its system offline. Shops stayed open, but again staff were forced to do everything manually. This resulted in a “higher level of markdown and waste caused by manual stock allocation” in its subsequent half-year results. Food had to be reduced or thrown out because M&S couldn’t manage it as efficiently without the technology it had been relying on. For a company that makes much of its ready meals, that must have been difficult to swallow.

Co-op was hit around the same time. Not only did it result in widespread shortages , payment problems and the loss of customer data, but it also disrupted deliveries to its stores. That might not sound like too much of a problem in parts of the UK where there’ll probably be a Tesco Express open until 11pm round the corner, but it’s quite a different proposition on remote Scottish islands where there isn’t an alternative food source. Photographs from Portree on Skye showed alarmingly empty shelves.

Sometimes, the problem starts before the food has even been delivered to the supermarket. Americold, a giant refrigerated warehousing business whose customers include Walmart, Nestle and McCain, was forced to take its systems offline in 2023 after a cyber attack left a significant number of its facilities unable to receive or ship out products. This time, the freezers didn’t need hacking. Without functioning logistics systems, the food couldn’t be reliably shipped out. For a supermarket waiting for deliveries, someone else’s cyber vulnerability can very quickly become their own.

Food factories are no more immune. In 2021, an attack disrupted JBS , one of the world’s biggest meat processors, causing problems in North America and Australia . The company paid a ransom of $11m (£7.8m) and said the interruption had only cost it less than a day’s production.

Cyber attacks can target any point within the food system

Cyber attacks can target any point within the food system

On farms, digital systems can control irrigation, monitor growing conditions and handle automated feeding or milking. Not every machine has an open internet connection and many of them have protections or manual overrides, but still: every extra connection needs protecting. A stolen password is bad enough. An irrigation system failing at the height of summer is another matter.

This is not a threat invented by excitable technology analysts. In its 2024 Food Security Report, the British government warned that “Cyber attacks can target any point within the food system”. The National Cyber Security Centre said ransomware was almost certain to be the greatest disruptive cyber threat to the sector. The more that digital systems were connected to the internet, it added, the more attractive and vulnerable food businesses are to attackers.

Banks have it easy. A quick phone call can suspend a transaction without anyone having to physically count the money. Strawberries, on the other hand, cannot be told to stop ripening until the IT department has finished investigating the ticket.

Last year, researchers Richard Jones and Dmitry Feoktistov reviewed 43 studies of cybersecurity across the food supply chain. They found a great many potential weaknesses, but also concluded that “systemic food security risks related to cybersecurity are not adequately addressed by the existing research literature”. Apparently, even establishing how widely certain technologies are used is surprisingly difficult.

So how prepared are we for these kinds of attacks? Well, official assessments are probably enough to keep supermarket bosses up at night. In September, the National Audit Office assessed the resilience of Britain’s food supply to serious disruptions, including cyberattacks, and found that “the sector’s ability to withstand catastrophic events that cause severe disruption has not been tested”. The watchdog also said that Defra had not done enough to ensure that resilience.

There are reasons not to panic and start living off-grid – though that does sound rather nice. The UK relies on many different food producers, retailers and suppliers, and businesses have backups in place when things do go wrong. Morrisons kept trading. M&S kept its stores open. JBS said the interruption had cost it less than a day’s production.

Even in the latest European attacks, Delhaize said its distribution centres were operating normally and deliveries had not been disrupted. For all the damage, individual stores losing their frozen food is still some distance from an entire country losing its food supply.

But the warning from Sir Ken McCallum , director-general of MI5 , last month was rather timely. Addressing Britain ’s wider national security threats, he said: “Our interconnected financial systems, energy grids, supply chains and manufacturing bases, designed during simpler times for maximum efficiency, are vulnerable to malicious disruption and coercion.”

Obviously, he was not claiming that the fridge hackers were targeting frozen peas on behalf of a hostile state. We don’t even know if the same people were behind the attacks. Nor that they were really singling out the food industry at all. But his broader point is worth a moment of thought. Most of the digital infrastructure we have come to rely on every day was originally built to work efficiently. To make our lives easier. It wasn’t built to withstand someone deliberately trying to break it.

The attacks on supermarkets across Europe show how the damage need not be spectacular to be serious. It can mean food wasted because the fridge has gone off or the software can’t find it in the warehouse. Deliveries can be delayed because the system has forgotten the addresses. A single shop can lose €100,000 of stock overnight without a hacker ever setting foot inside it.

Food security tends to conjure up visions of farms, extreme weather, conflicts blocking waterways many miles away and politicians being hyperbolic in the House of Commons. Increasingly, it also involves screens, keyboards, algorithms and lines of code doing their job out of sight.

Frozen peas don’t generally feature in our conversations national security. Perhaps they should.

Enjoy 6 months for £1

Join our commenting forum

Join thought-provoking conversations, follow other Independent readers and see their replies