Cyberattacks Raise Supermarket Freezer Temperatures to 50C Across 10 European Countries

Hackers remotely raised temperatures in supermarket freezers and refrigerators to as high as 50 degrees Celsius across at least 10 European countries on the night of November 1–2. Stores in Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia, Finland, Italy, Portugal and Germany reported the problem. Many discarded chilled and frozen goods that had thawed overnight.

Delhaize said about 40 of its stores in Belgium and Luxembourg were affected. Carrefour Belgium reported problems at 15 locations. Colruyt Group said five Spar franchise shops were hit. In Sweden, ICA and Coop stores lost stock after freezers were set to 50C. An ICA store in Sjöbo posted that its units had been hacked. SuperValu in Ireland removed products from 13 stores. A butchery chain in Hove, Belgium, reported meat worth about 15,000 euros ruined when temperatures climbed to 18C.

The method matched an earlier attack. On October 11–12, hackers compromised remote controllers for refrigeration systems at roughly 700 French supermarkets. Temperatures rose to 50C, some units caught fire, and losses ran into tens of millions of euros. The November wave used the same approach: switching evaporators into prolonged defrost mode through internet-connected controls. Belgian supplier Sabcobel said the technique targeted units it had manufactured.

No group has claimed responsibility. Belgium’s prosecutor’s office opened a criminal investigation. The European Union’s food and agriculture commissioner, Christophe Hansen, called the repeated attacks a deliberate attempt to disrupt the food supply chain and undermine consumer confidence. Retailers described the incidents as cyberattacks rather than mechanical failures.

The controllers are often reachable over the internet with known vulnerabilities. After the French attacks, Danish manufacturer Danfoss told customers to update hardware and software. Some stores that had not applied the patches or that used unsecured connections remained exposed. Attackers changed set points remotely without needing physical access. In several cases, store managers discovered the damage only after arriving in the morning to find freezers at room temperature or higher.

Losses varied by store. One Delhaize branch in Hoeilaart, Flanders, estimated 100,000 euros in spoiled produce, not counting the cost of closing. Larger chains said the overall impact was limited because only a fraction of locations were hit. Replenishment of chilled and frozen ranges began quickly in Ireland and Belgium. Still, empty shelves and carts of discarded food appeared in local reporting from Sweden and the Low Countries.

The second wave arrived three weeks after the French incident. Investigators have not publicly linked the two sets of attacks to the same operators, but the technical signature is similar. Both targeted internet-exposed refrigeration controllers rather than point-of-sale systems or customer data. The goal appears to have been disruption of food stocks rather than theft of information or ransom demands. No public ransomware notes have been reported.

Supermarket operators are now reviewing remote-access settings and patch status for refrigeration equipment. The attacks highlight a gap between consumer-facing cybersecurity and the industrial controls that keep perishable goods cold. Units that can be reached from the public internet remain vulnerable if default credentials or unpatched firmware are present. Several suppliers have issued new guidance since October.

European officials have treated the incidents as a supply-chain concern rather than isolated vandalism. Hansen’s statement framed them as an attempt to affect consumer confidence in the food system. Retail groups have not quantified total losses for the November wave, but individual store reports range from tens of thousands to six figures in euros. The French attack remains the larger of the two by number of stores and estimated cost.