European supermarkets experience refrigeration cyberattacks affecting multiple countries

Supermarkets in Sweden, the Netherlands, Belgium, Ireland, Luxembourg and Estonia were hit on Monday by cyberattacks that forced refrigeration and freezer units into defrost mode, raising temperatures to around 122 °F and leading to spoiled food. The incidents follow a similar attack in France last month that affected hundreds of stores.

The European Commission said the attacks illustrate how digital threats are increasingly impacting everyday life. Ahold Delhaize confirmed an "IT incident" affecting refrigeration systems in some Dutch stores and said its teams were assessing the situation. Stephan Moelans, chief executive of Belgian refrigeration firm Sabcobel, which maintains Delhaize’s equipment, described the event as a cyberattack that switched evaporators to defrost mode.

Colruyt Group reported that five Belgian Spar stores were affected, while Carrefour said a limited attack impacted 15 of its more than 700 Belgian locations. Sweden’s ICA chain said its central network was not compromised but that a few stores using an external supplier experienced the issue; the ICA Kvantum branch in Sjöbo posted on Facebook that its fridges and freezers had been hacked and were set to 122 °F, and it was discarding affected items. Coop disclosed that six Swedish stores were impacted.

In Ireland, food wholesaler Musgrave said refrigeration systems in 13 SuperValu stores were affected, prompting the removal of chilled and frozen products. An Estonian technology provider reported that a client’s refrigeration control computer had been accessed and temperature increased to 122 °F.

Sweden’s national cybersecurity centre, led by John Billow, is investigating the incidents and noted that many operational technology devices remain exposed and in need of updates or patches.