Hackers Hit European Supermarkets. Now Food Is Going to Waste

Supermarket freezers and refrigerators were remotely disrupted across several European countries on 2 November, forcing retailers to remove chilled and frozen food from affected stores after temperatures rose overnight. The incidents affected outlets in Belgium, Sweden, Ireland, Luxembourg and Estonia, with further reports involving Finland and smaller food businesses in the Netherlands.

The consequences were immediate. Some shops had to discard food that had spoiled or could no longer be considered safe to sell. In Sweden, one ICA store reported that its freezers had reached 50°C. In Belgium, a butcher estimated that the damage to one shop’s refrigeration systems had ruined around €15,000 worth of meat.

More than 115 stores and businesses were reported affected by BleepingComputer, although that figure has not been confirmed as an official total. Investigators have not established whether all the incidents were connected or who was responsible.

How hackers made supermarket freezers heat up

The incidents involved unauthorised changes to the settings of connected refrigeration equipment. In some affected locations, refrigerators and freezers stopped working properly or were switched into defrost cycles, allowing temperatures to rise instead of keeping food cold.

The consequences depended on the equipment and how quickly staff noticed the problem. Some stores had to remove chilled and frozen products, while others reported more limited disruption.

In Belgium, Stephan Moelans, chief executive of refrigeration installer Sabcobel, told Euronews that the affected equipment’s evaporators had been switched into defrost mode. He said the mechanism was the same as the one involved in the earlier French incidents.

That detail helps explain how a system designed to maintain safe storage temperatures could be manipulated to do the opposite. A defrost cycle is a normal part of refrigeration equipment’s operation. The problem arises when someone without permission can change how that equipment behaves.

The incidents were not simply ordinary refrigerator breakdowns. Several retailers and businesses explicitly described cyber incidents or unauthorised interference with their refrigeration systems.

Which supermarkets and food businesses were affected?

The impact varied by country, retailer and individual store. The following incidents were reported on 2 November.

Belgium and Luxembourg

Ahold Delhaize said an IT incident affected refrigeration systems at several dozen Delhaize stores in Belgium and Luxembourg. Carrefour reported problems at 15 of its more than 700 Belgian stores, while Colruyt Group confirmed that five Spar shops had been affected.

Intermarché locations were also included in reports about the Belgian disruption. IKEA confirmed that its store in Mons had experienced an incident involving refrigeration control systems.

A Belgian butcher in Hove, near Antwerp, reported a particularly costly outcome. Its refrigeration units reached temperatures of up to 18°C, ruining an estimated €15,000 worth of meat, according to owner Luc De Laet.

Sweden

Swedish supermarket groups ICA and Coop reported refrigeration problems at a limited number of locations.

Coop confirmed that seven of its more than 800 stores were affected. The problems ranged from refrigerators and freezers shutting down to equipment operating only partially. The company said the situation was contained and under control.

ICA also reported an overnight incident affecting a limited number of stores. One ICA location in Sjöbo said its refrigerators and freezers had been set to 50°C, forcing staff to discard affected products.

Ireland

Musgrave Group, which owns SuperValu, confirmed that refrigeration systems at 13 stores had been affected.

Chilled and frozen products were removed from sale as a precaution. Musgrave said the incident had been fully resolved on 2 November and that restocking was under way.

Estonia

One supermarket outlet operated by Selver was also reported affected. According to Estonia’s public broadcaster ERR, an attacker accessed a computer controlling a customer’s refrigeration system and raised its temperature.

The refrigeration technology company involved said the incident was addressed within minutes and caused no significant damage.

Finland and the Netherlands

Finnish media reported problems at several K Group supermarkets, although the available reporting provided less detail about the number of affected locations.

In the Netherlands, Danfoss told Dutch broadcaster NOS that refrigeration systems at at least 17 businesses had been attacked. These were mainly butcher shops and smaller local food businesses. The supplier said major Dutch supermarket chains were not known to have been affected.

BleepingComputer’s estimate of more than 115 affected stores and businesses includes locations across several of these countries. The figure should be treated as a reported tally rather than a confirmed count from investigators.

SuperValu removed food from 13 stores, but the incident was resolved

The Irish incident shows how a problem with equipment behind the scenes can quickly affect customers.

Musgrave said a cyber incident had affected refrigeration systems in 13 SuperValu stores. As a precaution, the company removed chilled and frozen products from sale.

The company later confirmed that the incident had been fully resolved on 2 November and that replenishment of affected product ranges was under way.

That distinction matters. The incident did not mean that all food in those stores was unsafe, or that SuperValu stores across Ireland had closed. Musgrave said the response was limited to the affected refrigeration systems and products.

Retailers have to make these decisions carefully. Food that has been kept outside safe temperature conditions may no longer be suitable for sale, even if it looks normal. Removing potentially affected products is therefore an important precaution, not evidence that every product in a store has been contaminated.

France faced a similar attack in October

The latest incidents follow a much larger refrigeration cyberattack in France on 11 and 12 October.

Hundreds of supermarkets and independent food retailers reported problems after attackers remotely manipulated connected refrigeration systems. Some units were reportedly set to reach temperatures as high as 50°C.

The damage was severe in some locations. Food was spoiled, refrigeration equipment was affected and fires were reported. In one account published by Le Monde, a supermarket owner described discovering that a cold-storage room had reached 50°C during the night.

French retailers affected included businesses operating under Intermarché, Netto, Coopérative U, Carrefour and Monoprix brands.

France’s authorities opened an investigation into the incident. The country’s cybercrime investigators were involved, but the available reporting has not established who carried out the attack or how the attackers gained access to every affected system.

The incidents in November have raised fresh concerns because they show that refrigeration equipment remains a target weeks after the French disruption.

Why connected refrigeration systems can become a target

Commercial refrigerators and freezers are not just standalone appliances. Many are connected to software that allows businesses, maintenance providers and equipment suppliers to monitor temperatures, receive alerts and change settings remotely.

These systems are useful because technicians do not need to visit every store to identify a problem or adjust equipment. A central management system can help retailers maintain hundreds of refrigeration units across different locations.

But remote access also creates a security risk. If a control system is exposed through an insecure connection, uses outdated software or has weak access restrictions, an unauthorised person may be able to change the equipment’s settings.

The November incidents have drawn attention to the software and remote-management systems used in commercial refrigeration. Danfoss, a Danish supplier whose technology was involved in the reported incidents, said outdated software was a key issue and that it had already urged customers to move to newer software.

Sabcobel’s chief executive also said that securing the connection used to manage refrigeration systems was important. He told Euronews that a software update alone might not be enough in some cases and that physical changes to equipment could be required.

These comments point to a broader challenge for businesses. Updating software is important, but it may not solve every weakness in a system’s network connection, configuration or physical installation.

Who is behind the supermarket attacks?

That remains unresolved.

No group has publicly claimed responsibility for the November incidents, and investigators have not confirmed whether the affected businesses were targeted by one organisation or by separate attackers using similar methods.

The absence of a confirmed ransom demand has also left the motive unclear. The incidents may have been intended to cause disruption, demonstrate access to vulnerable systems or serve another purpose. Those possibilities should not be treated as established explanations.

The Guardian quoted Rafe Pilling, senior director of threat intelligence at Sophos, discussing possible explanations that included state-linked signalling or an individual acting independently. That is an expert assessment of possible motives, not an attribution of the attacks to a particular country or group.

There is also an important distinction between the November incidents and the earlier cybersecurity incident reported by Ahold Delhaize to Dutch police. Reuters reported that the company had detected suspicious activity in its infrastructure in October. The available evidence does not establish that this earlier incident was connected to the refrigeration disruption.

Belgium’s federal prosecutor’s office has opened an investigation into the latest incident. The country’s Centre for Cybersecurity said it was aware of the situation but had no further information about those responsible.

Until investigators establish how access was obtained and whether the incidents share a common cause, claims about a coordinated campaign or a particular threat actor should be treated with caution.

What supermarket operators need to secure

The incidents are a warning for retailers and other businesses that rely on connected equipment to keep products safe.

Companies should review how refrigeration systems are accessed remotely and ensure that only authorised people and service providers can manage them. Remote connections should use secure networks, and equipment should run supported software with security updates applied where available.

Businesses should also review accounts used by external maintenance providers. Shared passwords, unnecessary access permissions and accounts that remain active after a contract ends can create avoidable risks.

Retailers should not assume that installing an update proves that a system has not already been accessed. If unauthorised changes are suspected, they should preserve relevant system records, involve the equipment supplier and investigate the incident before returning affected systems to normal operation.

There is also a physical safety issue. Stores need clear procedures for checking food after a refrigeration failure, using temperature records and appropriate food-safety guidance to decide what can remain on sale.

For refrigeration suppliers, the incidents underline the importance of secure remote-management design, supported software and clear advice to customers about outdated equipment.

A cyberattack does not have to steal data to cause damage

The supermarket incidents reveal a side of cybercrime that customers rarely see.

People usually associate hacking with stolen passwords, compromised bank accounts or leaked personal information. But an attacker who interferes with connected equipment can cause disruption without taking a customer’s data.

In this case, the consequences appeared in supermarket aisles and storage rooms. Staff had to check equipment, remove products and arrange replacement stock. Some businesses faced direct financial losses, while customers temporarily had fewer chilled and frozen products to choose from.

The reported incidents do not show that Europe is facing a food shortage. Supermarkets and food businesses were affected at individual locations, and some retailers said their operations remained open or that problems had already been resolved.

But the events in France in October and across several European countries in November raise a serious question for the retail industry: are the connected systems protecting everyday goods receiving the same security attention as the computers and networks businesses rely on?

A freezer may look like an ordinary piece of shop equipment. Once it is connected to a remote control system, however, it becomes part of a network that also needs to be protected.

How We Checked This

Secritic reviewed reporting from Reuters, The Associated Press, AFP, Euronews, The Guardian, BleepingComputer and Dutch broadcaster NOS, alongside statements from affected retailers and refrigeration businesses.

We separated incidents companies explicitly described as cyber incidents from cases where the cause was still under investigation. The figure of more than 115 affected locations comes from BleepingComputer and is not an officially confirmed total.

No attacker or group has been identified, and the November incidents have not been conclusively linked to one coordinated campaign. We have not presented them as a Europe-wide food-supply emergency.

Sources

Reporting and information used to examine the supermarket refrigeration cyberattacks.

• Reuters European retailers hit by supermarket fridge hack
• The Associated Press Supermarket freezers across Europe hit by suspected cyberattack
• Euronews Cyberattacks hit supermarket fridges and freezers in Europe
• BleepingComputer Hackers disrupt refrigeration systems at European supermarkets
• The Guardian Who is hacking Europe’s supermarket fridges and freezers, and why?
• AFP Fridge cyberattack hits supermarkets across Europe
• NL Times Fridges and freezers of 17 Dutch businesses attacked; large supermarkets unaffected
• Le Monde A disastrous day for French supermarkets after massive cyberattack targets refrigeration systems
• Reuters Hackers heat French supermarket fridges, sparking fires and spoiling food