Another cyberattack on supermarket fridges sweeps Europe, leaving food spoiled
The incident comes after a very similar cyberattack last month that sent fridge temperatures in some French supermarkets way up. While no one has claimed responsibility for either attack, they have heightened concerns among European authorities about hybrid threats to infrastructure, especially in the food system.
Incident comes after a similar attack on supermarket fridges in France last month
Thomson Reuters
·
Listen to this article
Estimated 6 minutes
The audio version of this article is generated by AI-based technology. Mispronunciations can occur. We are working with our partners to continually review and improve the results.
A hacking attack on European supermarkets spread across the continent on Monday, hitting fridges and freezers from Sweden to Belgium and forcing stores to throw away food in an incident that echoed a similar attack in France last month.
The attack, which raised temperatures in refrigerator and freezer units at dozens of stores, hit supermarket groups Ahold Delhaize and Colruyt in Belgium and Luxembourg, as well as Swedish grocers ICA and Coop. Furniture-to-meatballs retailer Ikea also saw at least one store affected.
"Everything is destroyed," Engla Ingwall, sales manager at an ICA franchise store in Stockholm, told Reuters during a visit to the store on Monday, adding the attack occurred at 2 a.m., but was only noticed hours later.
"There has been a cyberattack and all our freezers reached 50 degrees [Celsius]."
A spokesperson for privately held ICA said the company was aware that a "limited number of stores were affected by an incident overnight, which impacted their refrigeration and freezer systems."
The latest incidents follow an attack in France last month when police said hackers seized control of cooling units at hundreds of supermarkets, causing fires and food losses. Ahold Delhaize also reported a cybersecurity incident to police last month.
A notice informing customers that refrigerators are temporarily out of service is displayed on an empty case at the Delhaize Shop & Go store in Linkebeek, Belgium. (Stephanie Lecocq/Reuters)
While no one has claimed responsibility for either attack, the incidents have heightened concerns among European authorities about hybrid threats to infrastructure amid growing security tensions since Russia's 2022 invasion of Ukraine.
Moscow has repeatedly denied involvement in sabotage or hybrid warfare operations. Reuters could not establish who was behind Monday's attacks or whether they were linked to the incidents in France.
"It is not known who is behind this attack, and it may never be determined," said Katrien Eggers, spokesperson for Belgium's Centre for Cybersecurity, adding she was concerned about the growing number of incidents, in part due to AI.
"All IT systems are potentially vulnerable, and AI can now be used to successfully exploit these weaknesses — especially by sophisticated actors," she said.
'Retail is an easy target'
From refrigerators and heating systems to security cameras and alarms, an expanding range of devices, once largely mechanical, are now connected to the internet and can now be monitored and controlled remotely, creating new opportunities for cybercriminals.
At least some of the refrigerator units affected on Monday used temperature control technology from Danish firm Danfoss that was also targeted in the French attack. The firm said it had been working with customers to implement fixes.
During last month's French attack, Danfoss said the affected refrigeration units were running "outdated firmware," or had "reached end of life and no longer receive software or security updates."
After a cybersecurity firm detailed a potential vulnerability in Danfoss's systems over the summer that could allow hackers to gain access to the fridges and change their temperatures remotely, the company released a patch and urged customers to install it.
It wasn't the first time the food system had been targeted by hackers, cybersecurity analyst Ritesh Kotak told CBC News last month. In 2021, meat supplier JBS was hit by a cyberattack that temporarily shut down operations in Canada, the U.S. and Australia. And a 2025 attack on United Natural Foods Inc. led to shortages at many Whole Foods stores.
"This is something that, unfortunately, we're going to see more of," Kotak said, adding that the situation in France should serve as a "wake-up call" that such attacks need to be taken seriously.
Boxes of spoiled food are seen outside an Intermarche supermarket in Paris on Oct. 13, the day after a cyberattack targeted refrigeration systems at French supermarket chains, causing food losses and fires at several stores. (Lucien Libert/Reuters)
The European Commission said the latest incidents highlight how digital threats are becoming increasingly disruptive.
"They are a deliberate attempt to disrupt our food supply chain and undermine consumers' confidence in it — a warning that we must take seriously," said EU commissioner for agriculture Christophe Hansen. "The repeated occurrence of these cyberattacks is deeply concerning."
A spokesperson for Colruyt Group, which operates Spar stores in Belgium under a franchise system, said five shops had their fridge systems attacked.
In Ireland, wholesaler Musgrave said the incident affected systems in 13 of its SuperValu stores, forcing it to remove some chilled and frozen products from sale.
Tom Hegel, a researcher at cybersecurity firm SentinelOne, said such attacks are typically linked to extortion, political motives or nation-state operations, with the absence of financial demands in recent cases pointing instead to sabotage.
"Retail is an easy target because retail chains run enormous estates of refrigeration controllers, building management systems, door access panels and point-of-sale gear," he said, adding it was hard to trace hackers targeting such systems.
"An attacker who logs into an exposed control panel leaves almost nothing behind ... A teenager and an intelligence service would look much the same from the defender's side."
WATCH | How AI can supercharge cyberattacks:
AI can make cyberattacks faster and smarter
April 5|
Duration
1:29
A new EY report suggests AI will become a major force behind cybercrime in 2026 as programs help attackers hone their scamming skills.Grocers tossing thousands of dollars worth of food
Carrefour, which was badly hit in last month's French attack, said 15 of its 700 stores in Belgium were affected. Ikea said one store in Belgium had been impacted and that it could not rule out disruptions at other locations.
Privately held Swedish grocery chain Coop said that seven of its 800 stores were affected by a cyber incident involving unauthorized tampering with its refrigeration systems. It said Danfoss was among its suppliers.
Luc De Laet, founder and owner of Belgian butchery chain De Laet & Van Haver, said he was woken at 3:30 a.m. by an employee telling him there was a problem. He rushed to his store south of Antwerp and found the fridges turned up as high as 18 C.
WATCH | How a vulnerability widely-used internet language sent websites scrambling:
PHP flaw: How AI just hacked an unhackable part of the internet | About That
October 23|
Duration
11:28
A security leak in the foundational PHP code that powers most of the internet has triggered a worldwide alert, forcing governments and major companies to take websites offline. Andrew Chang breaks down how advanced AI uncovered the vulnerability — and the race between defenders and hackers to secure the system. (Photo credits: The Canadian Press, Reuters, Adobe Stock and Getty Images)He estimated the incident ruined about €15,000 ($23,485 Cdn) worth of meat.
"It's very scary. They are hacking the system that is doing the registration of the temperature, and they can program it at a distance," he told Reuters, adding that it was infuriating to throw away so much food.
De Laet said he believed the hackers were trying to destabilize European economies. He had contacted police but did not know whether an investigation had been launched.
"I only have two words for them: Wake up, please, because there's something going on," he said.
KioskNews shows a cleaned-up reading view extracted from the publisher’s page — the original always lives on their site, not ours.