Supermarket Freezer Cyber-Attack Hits Stores in Nine European Countries

A supermarket freezer cyber-attack has hit food retailers in at least nine European countries. Stores have had to throw away large amounts of chilled and frozen food. Hackers pushed temperatures in some units as high as 50C. As of Tuesday, November 3, no one has claimed responsibility. The European Union, however, says the attackers deliberately set out to disrupt how food reaches shops.

How the supermarket freezer cyber-attack unfolded

The attacks happened overnight into Monday, November 2. According to the BBC, retailers in nine countries reported problems: Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden.

Belgium was among the hardest hit. Roughly 40 Delhaize stores across Belgium and Luxembourg were among the victims. In addition, Carrefour said 15 of its Belgian stores were hit, and Colruyt Group said five Spar shops had their fridge systems attacked. IKEA also reported problems at one store in Mons.

Elsewhere, Musgrave Group said the problem hit 13 SuperValu stores in Ireland. In Sweden, seven of Coop’s 800 stores and a small number of ICA stores were hit. Meanwhile, in Portugal, seven Intermarché stores reported problems. Their owner said the attack appeared to target an outside company that manages refrigeration systems.

The financial losses are significant. One Delhaize branch near Brussels told local media it lost about €100,000 worth of food. A Delhaize manager, Mathieu Tilman, told the BBC the waste was “truly distressing”.

How the hackers did it

The method appears simple but effective. Sabcobel, a Belgian company that makes and runs some of the affected units, said attackers switched the units’ evaporators into defrost mode. As a result, the cabinets warmed up.

At least some of the affected units used temperature controls from the Danish firm Danfoss, Reuters reported. Danfoss said it had been working with customers on fixes. Its systems were also targeted in a similar attack on French supermarkets in early October.

That earlier attack hit hundreds of French stores and wiped out food worth tens of millions of euros, according to estimates. According to the BBC, it exploited weaknesses in remote-control systems that security researchers had flagged months earlier.

Sabcobel’s chief executive, Stephan Moelans, said fixing the problem fully required physical changes to the units, not just software updates. He added that most customers had moved to secure connections after the French incident.

UK food businesses also affected

Britain has also felt the impact. The National Cyber Security Centre (NCSC) said it knew of “a couple of instances” where attackers had exploited vulnerable technology in the UK. Its chief executive, Richard Horne, said staff had worked through the night to warn organisations with exposed systems.

The British Association of Independent Meat Suppliers said some members had become “collateral” in the attack. In one case, cold units rose to 100C. Fortunately, the affected units were empty, so no food was lost. The NCSC said the overall UK impact was “minimal” so far.

Who could be behind it?

So far, attribution remains unclear. Horne said it was “too early to say” who was responsible. Likewise, a spokesperson for Belgium’s Centre for Cybersecurity said investigators may never identify the culprit.

Nevertheless, the attacks have raised concern about so-called hybrid threats to European infrastructure. Russia has repeatedly denied involvement in sabotage, and Reuters could not establish who carried out Monday’s attacks. Tom Hegel, a researcher at SentinelOne, said the absence of ransom demands pointed towards sabotage rather than extortion.

EU agriculture commissioner Christophe Hansen called the incidents “a deliberate attempt to disrupt our food supply chain”. In Italy, Prime Minister Giorgia Meloni’s office said the impact there was “very limited”. It added that affected businesses mostly used outdated systems exposed directly to the internet.

Why it matters beyond Europe

People can now control many everyday devices online, including fridges, heating systems, cameras and door locks. Consequently, every connected device can become a possible entry point for attackers. Experts say older systems left online without updates make especially easy targets.

For businesses, the lesson is clear. Security officials advise firms to update control software, use strong passwords and keep critical equipment off the open internet. In short, as Horne put it, organisations must “invest in renewal”. Investigations are continuing in several countries, including a Belgian federal inquiry.