Cyberattack hits supermarket cooling systems across Europe, forcing food disposal

Supermarkets across Europe were forced to discard chilled and frozen food after a cyberattack raised temperatures in their cooling systems on Monday, Nov. 2. Dozens of stores were affected, including locations operated by Ahold Delhaize and Colruyt in Belgium and Luxembourg, and Swedish grocery chains ICA and Coop. Ikea also reported disruption at a Belgian store.

At an ICA franchise in Stockholm, sales manager Engla Ingwall told Reuters that the attack happened at 2 a.m. but went unnoticed for hours. She said all the store's freezers reached 50 C, destroying their contents. ICA confirmed that an overnight incident had affected refrigeration and freezer systems at a limited number of stores.

The reported impact varied among retailers. Colruyt said five shops were affected, while Carrefour reported incidents at 15 of its 700 Belgian stores. Coop said seven of its 800 Swedish stores experienced unauthorized interference with refrigeration systems. In Ireland, wholesaler Musgrave removed some chilled and frozen products from sale after systems at 13 SuperValu stores were affected. Ikea could not rule out disruption beyond its confirmed Belgian location.

Belgian butcher Luc De Laet said an employee alerted him to a problem at 3:30 a.m. He arrived at his shop south of Antwerp to find refrigerator temperatures as high as 18 C. De Laet, founder and owner of De Laet & Van Haver, estimated that about €15,000 worth of meat had been ruined. He contacted police but did not know whether an investigation had begun.

The incidents followed an attack in France last month in which police said hackers took control of cooling equipment at hundreds of supermarkets, causing food losses and fires. Ahold Delhaize separately reported a cybersecurity incident to police last month. No one has claimed responsibility for either attack, and Reuters could not establish who carried out Monday's incidents or whether they were connected to those in France.

Some equipment affected on Monday used temperature control technology supplied by Denmark's Danfoss, whose systems were also targeted in France. The company said it was working with customers on fixes. After a cybersecurity firm described a potential vulnerability over the summer that could permit remote access and temperature changes, Danfoss issued a patch and urged customers to install it. During the French attack, the company said affected units had outdated firmware or no longer received software or security updates.

The attacks illustrate the exposure created as equipment such as refrigerators, heating systems, cameras and alarms becomes connected to the internet. Katrien Eggers, spokesperson for Belgium's Centre for Cybersecurity, said identifying those responsible might prove impossible. She also expressed concern that artificial intelligence was helping sophisticated actors exploit weaknesses in IT systems.

SentinelOne researcher Tom Hegel said attacks of this kind commonly involve extortion, political objectives or state operations. He said the lack of financial demands in recent cases pointed toward sabotage, while the large number of connected devices used by retailers made them accessible targets. Intruders accessing exposed control panels can leave little evidence, making attribution difficult.

European authorities have become increasingly concerned about hybrid threats to infrastructure amid security tensions following Russia's 2022 invasion of Ukraine. Moscow has repeatedly denied involvement in sabotage or hybrid warfare. EU agriculture commissioner Christophe Hansen described the repeated attacks as deeply concerning, saying they sought to disrupt food supplies and weaken consumer confidence.