European Supermarkets Hit by Second Wave of Refrigeration Cyberattacks

Supermarket refrigeration systems in at least seven European countries have been affected by suspected cyberattacks that caused refrigerator and freezer temperatures to rise and food to spoil, while Belgian prosecutors have opened a criminal investigation into the incidents, according to reports by DW, Euronews and Reuters.

Stores in Belgium, Sweden, Estonia, the Netherlands, Luxembourg, Ireland and Finland have reported problems similar to an attack in France on October 12, when hundreds of supermarkets belonging to the Intermarché and Coopérative U chains were targeted. The latest incidents appear to have occurred overnight from Sunday into Monday, with refrigeration systems remotely switched to defrost mode or temperatures raised.

In Sweden, supermarket chains ICA and Coop confirmed that a limited number of their stores had been affected. ICA spokeswoman Helena Johansson said the company was investigating the circumstances and the extent of the disruption. Coop spokesman Carlos Cancino told AFP that six of the chain's approximately 800 Swedish stores were affected, with some refrigerators and freezers completely out of service and others partially impaired. He said he had received no information confirming that the incident was a cyberattack.

The ICA Kvantum store in Sjobo, southern Sweden, reported that the temperature settings in its refrigeration systems had been remotely raised to 50 degrees Celsius, or 122 degrees Fahrenheit. Sweden's National Cybersecurity Center director John Billow told Reuters that his agency was investigating the incident.

Billow also said the authorities had recently identified numerous operational technology devices in Sweden that remained exposed to security risks despite repeated warnings that they needed software updates or patches. These include refrigeration and heating equipment, surveillance cameras, alarm systems and other devices that were once largely mechanical but are increasingly monitored and controlled remotely.

In Belgium, supermarkets operated by Delhaize, Carrefour, Intermarché and Spar were among those affected. The butchery group De Laet en Van Haver also reported problems with its refrigeration equipment, while IKEA said its store in Bergen, near Mons, had been hit. The total number of affected Belgian locations was reported at 75.

According to Belgian outlet Le Soir, the affected businesses included around 40 Delhaize Proxy supermarkets, 15 Carrefour Shop & Go stores, 15 Intermarché outlets and five Spar Q8 service station locations.

Delhaize said several dozen of its stores had experienced an IT incident affecting refrigeration equipment, but that immediate measures had been taken to keep them operating. Carrefour initially reported that 15 of its 700 Belgian stores in Flanders and Wallonia had been affected, with no hypermarkets involved. The company said the disruption was limited to a small number of refrigeration units, mainly freezers, and that all stores remained open.

Carrefour Belgium spokesman Mich Vergauwen later confirmed that the incident was a cyberattack, saying there was no other explanation, while stressing that its impact was limited.

Belgium's Centre for Cybersecurity (CCB) confirmed to the Belga news agency that it was aware of an incident involving supermarket refrigeration systems. CCB spokeswoman Katrien Eggers said the center had no further details. Authorities have not identified those responsible for the attacks.

Belgium's federal prosecutor's office has launched a criminal investigation, a spokesperson told Reuters.

Stephan Moelans, chief executive of Sabcobel, the refrigeration installation company responsible for managing Delhaize's cooling systems, told Belga that the Belgian incident used the same method as the attack in France. He said the affected units had been switched into defrost mode by manipulating their evaporators.

Moelans said his company had spent recent weeks working to protect customers' refrigeration systems against the vulnerability. He added that installing a software update alone would not resolve the problem and that physical changes to the equipment were also necessary.

Securing the systems through protected internet connections was the most straightforward approach, he said, noting that most of Sabcobel's customers had adopted this arrangement following the French attack. The company was aware of around 20 affected refrigeration units among the hundreds it manages across Belgium.

Danfoss, which supplied the software used in the refrigeration systems affected in both the latest incident and the October attack in France, said customers who had not updated their software were vulnerable. A company spokesperson told VTM NIEUWS that the main weakness was in outdated software and that customers had already been urged to switch to the updated version.

In the Netherlands, Ahold Delhaize reported an overnight IT incident affecting freezer systems in several stores in Belgium and Luxembourg. Danfoss also said that cooling and freezing systems belonging to at least 17 companies in the Netherlands had been attacked, although it did not disclose their identities. As a precaution, Delhaize suspended its ordering systems in Luxembourg to prevent a similar disruption.

In Ireland, 13 SuperValu supermarkets were affected by a suspected cyber incident, according to a statement from owner Musgrave to The Irish Times. Irish public broadcaster RTE also reported that 13 supermarkets had been hit.

In Estonia, media reports identified one affected location belonging to supermarket chain Selver. Finnish media reported problems at several K Group supermarkets, part of one of the country's largest retail chains.

European Commissioner for Agriculture and Food Christophe Hansen described the incidents as “a deliberate attempt to disrupt Europe's food supplies,” while saying that although food security was not currently threatened, the resulting food waste and damage to businesses were real.

A European Commission spokesperson said the attacks demonstrated how cyber incidents could interrupt services, harm businesses and directly disrupt people's everyday lives.

The latest incidents have renewed concerns about food security and the vulnerability of supermarket refrigeration systems following the October 12 attack in France, which affected hundreds of Intermarché and Coopérative U stores.