Cyber Attacks Target European Supermarket Refrigeration Systems

Coordinated Attacks On Food Infrastructure

Suspected cyberattacks have targeted supermarket refrigeration systems across eight European countries, leading to significant food losses and operational disruptions. EU Agriculture and Food Commissioner Christophe Hansen described these incidents as a deliberate attempt to disrupt food security. The attacks affected retail chains in Sweden, Belgium, Estonia, Luxembourg, the Netherlands, Ireland, and Denmark, while retailers in Finland also investigated temperature irregularities.

In Belgium, prosecutors have opened a criminal investigation into the coordinated incidents. Affected businesses include Delhaize, Carrefour, and Spar supermarkets, as well as an IKEA store in Mons. Reports indicate that attackers remotely switched evaporators to defrost mode, causing temperatures to rise and forcing retailers to discard large quantities of goods. One shopkeeper estimated that at least €60,000 worth of food was discarded due to the breach. Carrefour confirmed that 15 of its stores were targeted across Flanders and Wallonia, while Ahold Delhaize reported an IT incident affecting dozens of locations in Belgium and Luxembourg. Other retailers, including Colruyt and Intermarche, reported refrigeration problems at five and around 15 stores respectively, though they did not explicitly confirm cyberattacks.

Impact Across Northern Europe

Sweden experienced significant disruptions, with several ICA and Coop stores reporting failures. In the Skane, Oland, Varmland, and Stockholm regions, ICA stores reported failures, while Coop saw incidents in Gastrikland and Halsingland. In one specific instance at ICA Nara in Boda, manager Mats Olsson discovered water covering the floor and a freezer reading 55°C (131°F) after units were remotely switched off. ICA noted that the affected connections were outside its central network, while Coop confirmed unauthorized manipulation and identified Danfoss as one of its suppliers. Coop stated that the incident affected seven out of more than 800 stores and was contained before a planned system upgrade.

In Ireland, Musgrave reported that a suspected cyberattack affected a specific refrigeration model at 13 SuperValu stores. Monitoring systems detected the issue, and chilled goods were withdrawn as a precaution. The company later confirmed that the problems were fully resolved and all stores returned to normal operations. Similarly, Danish food producers were targeted, though an adviser noted that a supplier was able to stop the attack and implement preventive measures.

System Vulnerabilities And Global Patterns

Investigation into the breaches revealed that many targeted systems lacked centralized protection or used outdated software. In the Netherlands, at least 17 businesses, including butcher shops and frozen food storage facilities, were targeted. Danfoss reported that these systems often used default passwords and were located outside secure networks. In Estonia, hackers accessed a computer controlling refrigeration at a Selver supermarket to alter freezer temperatures. Finnish retailer Kesko also reported temperature problems at a few stores, with security chief Petri Kayhko noting that the affected equipment was outside centralized protection.

These events echo a similar pattern of attacks seen in France the previous month, where hundreds of stores experienced hacked refrigeration systems with temperatures set to 50°C (122°F). The vulnerability appears to be linked to specific refrigeration models and software versions. Beyond Europe, similar cyberattacks were reported at several military bases in the United States in August, where at least six on-base grocery stores were affected in a similar manner. The Pentagon is currently investigating those incidents.

Retailers and suppliers are now focusing on upgrading software and moving refrigeration controls into secure, centralized networks to prevent further disruptions. The coordinated nature of these attacks across multiple borders highlights a growing vulnerability in the automated systems that manage the European food supply chain. Authorities continue to monitor the situation as they work to identify the perpetrators behind the defrost attacks, which have caused significant financial losses for small and large retailers alike.