ع
A series of cyber-attacks struck supermarket refrigeration systems across nine European countries on November 2, placing Europe on alert after supermarket freezers hit by cyber-attacks in nine countries, with officials from the European Union warning of a deliberate effort to destabilise the food supply chain, multiple news outlets including the BBC and Reuters reported. According to Reuters, chains including Ahold Delhaize, Carrefour, Coop and SuperValu saw temperatures in freezers and chillers rise dramatically overnight, resulting in significant food spoilage and waste. The European Commission has described the coordinated intrusions as a deliberate attempt to disrupt the bloc’s food supply, a development that comes just three weeks after a similar large-scale attack targeted French retailers.
In Belgium, one of the hardest hit nations, around 40 Delhaize stores along with 15 Carrefour outlets and five Spar locations experienced the malfunction, a Belgian refrigeration company executive told local media. Sweden saw six to seven Coop stores and a limited number of ICA supermarkets affected, with one store manager informing TV4 that staff arrived to find freezers blowing hot air at 50C. Ireland’s Musgrave Group, operator of SuperValu, confirmed 13 stores were impacted by what it termed a cyber-incident, prompting immediate replenishment efforts, the company said in a statement. Euronews listed Italy, Portugal, Estonia, Finland, Luxembourg and the Netherlands among the other affected countries where similar temperature spikes occurred.
The latest wave follows an October attack that disrupted as many as 700 French grocery stores, where losses from spoiled inventory reached tens of millions of euros, according to French authorities cited by the Financial Times. That incident, like the current one, appears to have exploited internet-exposed controllers on refrigeration units supplied by manufacturers such as Danfoss, a Danish firm that acknowledged working with customers on security patches after the French events. Security researchers have pointed out that many such systems are legacy devices without available updates, left connected to the internet and vulnerable to remote tampering, as noted in commentary on Help Net Security.
Belgian company Sabcobel, which provides equipment to several affected chains, explained that attackers switched evaporators to defrost mode via a backdoor in the control systems of stores not using secure connections, according to the Financial Times. Prosecutors in Belgium have opened an investigation into the incidents, while Sweden’s national cybersecurity centre is also probing the attacks, Reuters reported. No group has claimed responsibility so far, leaving investigators to consider whether the campaign represents a test of infrastructure weaknesses or the work of state-linked actors.
EU officials have expressed particular concern over the potential for such operations to erode public trust in food systems at a time of heightened geopolitical tensions. A Guardian analysis suggested that state-backed hackers from Russia or China could be responsible, given the psychological impact of empty shelves, though no evidence has been made public to support specific attributions. The incidents have also drawn parallels to reported probes by the Pentagon into similar refrigeration attacks at US military commissaries, highlighting a pattern of targeting cold chain logistics.
Industry experts have long warned about the risks to operational technology in retail supply chains, with a Computer Weekly report noting that the attacks underscore insufficient segmentation between IT and OT networks. In Finland, cybersecurity officials identified dozens of exposed Danfoss controllers following the French precedent, according to local media. Retailers affected have moved quickly to restore systems, with most stores remaining open and restocking under way, though the cumulative financial impact remains under assessment.
