Suspected Cyber-Attack Hits Supermarket Freezers Across Three More Countries

Refrigerators and freezers in dozens of supermarkets across Sweden, Belgium and Luxembourg overheated overnight in what retailers fear is a second cyber-attack on cold-chain systems, echoing a hack that cost French chains millions of euros in spoiled food.

Sweden's Coop told the daily Aftonbladet on Monday that six of its stores were affected. Rival ICA said it was "aware that a limited number of stores were affected by an incident overnight which impacted their refrigeration and freezer systems." Neither chain confirmed the cause.

Ahold Delhaize, the Dutch retail giant, said an "IT incident" had hit fridges and freezers in dozens of its supermarkets in Belgium and Luxembourg. The company reported a separate cybersecurity incident to Dutch police last month, though it hasn't confirmed the two events are linked.

"Temperatures in the cooling systems had increased," company spokesperson Sarah De Meester said, adding that the incident is under investigation.

Which stores were hit?

Belgium's Le Soir newspaper reported dozens of affected outlets, including:

• Five Spar stores
• Multiple Shop & Go convenience shops attached to Q8 service stations
• Several smaller Proxy Delhaize minimarkets

Repair crews worked through the night. "We started mobilising technicians at 1am," Stephan Moelans, chief executive of refrigeration installer Sabcobel, told Le Soir. "We spent all night and morning disconnecting the affected installations from the grid."

Why does this look like France's attack?

French police said in October that hackers had seized control of cooling units at up to 700 supermarkets in a large-scale attack. Intermarché, Coopérative U, Carrefour, Leclerc and Monoprix were among the affected chains.

The hackers remotely overrode settings on thousands of freezers, fridges and chiller cabinets, pushing temperatures from as low as -27C to well over 50C. That's a swing of nearly 80 degrees — enough to destroy an entire cold aisle in hours.

Stores had to bin vast quantities of fresh meat, dairy and frozen goods. Losses ranged from tens of thousands of euros to more than €130,000 (£109,000) per store. Two outlets in Alsace reported a combined loss of €270,000.

How did the hackers get in?

Most supermarket cold aisles connect to the internet so contractors can do remote maintenance and receive alerts when systems fail. That convenience is the attack surface.

In the French case, hackers pirated controllers mostly supplied by the Danish company Danfoss. They disabled alarm systems first, then adjusted thermostats or extended defrost programmes by hours — so failures went unnoticed while food quietly spoiled.

Danfoss said it identified security flaws last year and has "long recommended" that customers install updates. In other words, patches existed; many operators hadn't applied them. ANSSI, France's national cybersecurity agency, later confirmed that supermarkets using controllers from two other companies were also targeted in the same attack.

What does this change for retailers and suppliers?

The Paris prosecutor's office has opened a formal investigation into the French attack, citing damage that included "food losses and fires." Prime Minister Sébastien Lecornu instructed ANSSI to investigate, and the agency's finding that three controller brands were compromised widened the exposure well beyond Danfoss customers.

For supermarket operators, the practical question is no longer whether remote-controlled cooling is vulnerable — it's whether their installed controllers are patched and whether alarms can be disabled remotely. For food suppliers and insurers, per-store losses topping €130,000 make cold-chain cyber risk a line item that can no longer sit with generic IT security.

If investigators confirm the Swedish, Belgian and Luxembourg incidents are part of the same campaign, retailers across Europe face a repeat attack on infrastructure that was known to be flawed more than a year ago.