Europe is facing a fresh wave of suspected cyberattacks targeting supermarket refrigeration systems.
Stores across seven European countries reported refrigeration problems on Nov. 2 after overnight disruptions, with an ICA store in Sweden saying its fridges and freezers had been set to 50°C (122°F). Affected retailers removed chilled and frozen products from sale.
The latest incidents were reported in Belgium, Luxembourg, Sweden, Ireland, Estonia, the Netherlands, and Finland, following a separate October attack on hundreds of French supermarkets. In Belgium, refrigeration units were reportedly switched into defrost mode. Although several businesses confirmed cyberattacks, the cause of every malfunction remains unclear.
For European retailers, the disruptions raise concerns about remotely accessible equipment, food safety, inventory losses, and potential store closures.
Seven countries face disrupted cooling and costly food losses
The Associated Press reported that an ICA store in Sjöbo, Sweden, said its fridges and freezers were set to 50°C and staff discarded affected food. In Estonia, refrigeration supplier Kitman Coldtech said it contained the incident within minutes, without significant damage.
Reuters, in reporting published by CNBC, said seven Swedish Coop stores and 15 Belgian Carrefour stores were affected. A Belgian butcher estimated €15,000 in spoiled meat.
The BBC reported roughly 40 affected Delhaize stores across Belgium and Luxembourg. One branch in Hoeilaart estimated €100,000 in spoiled produce, excluding closure losses.
Ireland’s 13 affected SuperValu outlets shared a refrigerator model, while Dutch reports identified at least 17 businesses. Finland’s Kesko was still investigating similar failures, so their cause remains unconfirmed.
Remote defrost controls expose a risk beyond data breaches
Belgian refrigeration operator Sabcobel said affected evaporators had been switched into defrost mode. CEO Stephan Moelans told the Belga news agency that technicians had been “working all night and morning to disconnect the affected units from the network,” according to the BBC. He said some protections require physical modifications, not just software updates.
The October attacks in France reportedly affected up to 700 shops, according to The Guardian.
An October CERT-FR alert identified compromises involving Danfoss AK-SM and AK-SC controllers, alongside Copeland and Dixell XWEB systems. It recommended removing public internet exposure, checking controller configurations, and restoring remote access through a secure VPN or protected network. The alert does not establish which equipment or vulnerabilities were involved in every November disruption.
Tributech expert Patrick Lamplmair warned, “A few commands to a temperature controller can destroy stock overnight and close stores,” The Guardian reported.
Investigators have not identified the perpetrators or established a connection between the October and November incidents.
What retail IT teams should check before restoring remote access
Refrigeration controllers directly affect food safety and store operations. Retail IT teams should work with facilities staff and refrigeration contractors to identify controller models, firmware versions, remote connections, and maintenance accounts. That inventory should include independently operated stores and equipment outside the central corporate network.
For systems covered by CERT-FR’s October alert, the recommended protections include removing public internet exposure, checking configurations such as defrost schedules, updating firmware, and changing default passwords. The agency warned that a factory reset alone leaves vulnerable equipment open to another compromise if it remains exposed. Retailers should confirm the appropriate steps with their equipment suppliers before restoring remote access.
Responsibility also needs to be clear after hours. Store managers and contractors should agree on who receives temperature alerts, who responds overnight, and how remote access can be isolated while maintaining safe refrigeration. Where feasible, teams should test temperature monitoring independently of the controller, because a compromised control system may also undermine confidence in its readings. These checks belong in an operational technology security plan.
Recovery requires separate decisions about equipment and food. Restoring normal controller settings does not establish that affected stock is safe to sell. Staff should preserve temperature records, quarantine questionable products pending food-safety assessment, document losses, and confirm stable operation before restocking.
The priority is knowing which systems require isolation and how to maintain essential operations while protections are applied. European government website shutdowns following critical PHP flaws illustrate the operational trade-offs involved in taking exposed services offline. Retailers should also examine supplier access and responsibilities: Lidl’s customer data breach through a third-party provider involved a different kind of incident, but reinforces the need to understand security dependencies outside the business.
Stay informed: Keep up with Europe’s latest technology, AI, and cybersecurity developments. Subscribe to Tech Insider Europe for free for essential coverage of the region’s evolving technology landscape.