Cyberattack disrupts European supermarket freezers

Supermarkets in Sweden, Belgium, Luxembourg, Ireland, and Estonia reported operational failures in their refrigeration units on Monday, Nov. 2. The disruptions appeared to stem from cyberattacks that allowed unauthorized access to temperature controls, forcing staff to discard spoiled inventory.

The incidents follow a similar event in France during the previous month. In that case, attackers remotely manipulated refrigeration systems in hundreds of stores and independent shops, causing internal temperatures to spike rapidly. This latest wave of attacks suggests a continued focus on cooling infrastructure across the continent.

In Sweden, Gustaf Nilsson, a spokesperson for the ICA Group, confirmed that a limited number of stores were affected overnight. He did not specify the exact count. At an ICA Kvantum location in Sjöbo, staff reported that hacked units had been set to 50 degrees Celsius, which is 122 degrees Fahrenheit. The store posted on Facebook that employees were throwing away affected products. The Coop chain also identified six stores in central Sweden experiencing similar issues, according to reports from the TT news agency.

In Belgium and Luxembourg, the Delhaize chain described the event as an IT incident affecting several dozen locations. Spokesperson Sarah De Meester stated that distribution centers remained operational and that deliveries to stores continued without disruption. Carrefour reported that 15 of its more than 700 stores in Belgium faced a cyberattack targeting refrigeration, characterizing the impact as extremely limited.

Estonian officials reported that attackers accessed a computer controlling a client’s refrigeration system, raising the temperature to 50 degrees Celsius. Jann Mutso, chief executive of Kitman Coldtech, said the issue was addressed within minutes. The Selver supermarket chain confirmed that one of its outlets was part of the affected group. Mutso declined to name the specific store but noted that the damage was minor.

In Ireland, the Musgrave Group said 13 SuperValu stores experienced a cyber incident. A spokesperson explained that chilled and frozen products were removed from sale as a precautionary measure. By Monday afternoon, the company announced the incident was fully resolved. Replenishment of the affected product ranges was already under way in those stores.

The French incidents from last month appeared to target older computer systems, a detail that may inform how retailers in other countries assess their own vulnerabilities. Current reports from the five affected countries do not yet confirm whether the same software weaknesses were exploited.