A cyberattack hit refrigeration systems at supermarkets across seven European countries overnight Sunday into Monday, pushing freezer temperatures as high as 50 degrees Celsius and spoiling food at chains including Delhaize, Carrefour, IKEA, Coop and SuperValu. Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia and Finland were all affected, in what security researchers believe was carried out using the same method as an October attack that hit hundreds of French supermarkets.
Around 40 Delhaize stores in Belgium and Luxembourg were hit, with smaller numbers affected elsewhere: 15 Carrefour stores in Belgium, five Colruyt-run Spar shops, an IKEA store in Mons, seven of Sweden's roughly 800 Coop locations, 13 SuperValu stores in Ireland, and more than a dozen companies' systems in the Netherlands. One Delhaize branch in Hoeilaart, Belgium, lost an estimated 100,000 euros of produce, not counting the cost of closing while technicians worked.
How the attack worked
Stephan Moelans, chief executive of Sabcobel, the Belgian firm that operates Delhaize's refrigeration systems, told the Belga news agency the incident was a cyberattack and that his company had been "working all night and morning to disconnect the affected units from the network." He said most customers had already moved to managing their fridges over a secure internet connection after the French attack last month — a measure that appears to have limited, but not prevented, Monday's damage. One ICA store in Sjobo, Sweden, wrote on social media that "our refrigerators and freezers have been hacked overnight and they have set the temperature to 50 degrees."
Tom Hegel, a cybersecurity researcher at SentinelOne, said the incident underscores a gap in how retailers think about industrial equipment. "The question retailers need to answer is who owns the security of that equipment, not just who repairs it," he said. "Once an attacker can operate those controls, legitimate functions such as defrosting become tools for disruption. Changing a setting can destroy physical stock, not just interrupt a computer system." Ciaran Martin, former head of the UK's National Cyber Security Centre, said the episode reflects a broader failure of industrial design: "There's a lot more that we need to demand of big tech to give us safer devices and products in the first place."
A second wave, no culprit named
No individual or group had claimed responsibility as of Monday night. The attack follows an October wave against French chains including Intermarche and Carrefour that reportedly cost tens of millions of euros; Britain's National Cyber Security Centre and cyber agencies in Belgium and Sweden are now monitoring the fallout. U.S. authorities have separately been examining similar refrigeration malfunctions at American military bases in August and are comparing notes with French investigators, according to the BBC. For now, the chains affected are racing to replace spoiled stock and shift their refrigeration networks onto more isolated connections, even as the attackers' identity and next target remain unknown.
