Hackers Remotely Defrost European Supermarket Refrigeration Systems
Widespread cyberattacks force grocery chains to discard massive amounts of perishable inventory.
1Coordinated Refrigeration Cyberattacks
Grocery chains across Belgium, Ireland, Luxembourg, and Sweden report widespread food wastage following remote cyberattacks. Attackers manipulated commercial refrigeration and freezer systems by forcing them into defrost mode overnight. This unauthorized access caused internal temperatures to spike up to 50ºC, rendering fresh and frozen inventory entirely unsalvageable for affected retailers.
2Operational Impact on Retailers
In Belgium, approximately 40 Delhaize stores suffered significant losses, with managers describing the situation as catastrophic. Similar disruptions hit Carrefour, Intermarché, Spar, and Shop & Go locations. While distribution centers remain operational, the immediate loss of perishable stock has created temporary supply limitations for customers across these major retail chains.
3Swedish Market Disruptions
Swedish retailer ICA confirmed that a small number of its stores, operating outside the central network, were compromised. Store manager Mats Olsson reported finding freezers set to 55ºC, resulting in total product loss. Additionally, six Coop locations in central Sweden experienced identical refrigeration failures, leaving some stores without any fresh produce to sell.
4Irish Retail Sector Losses
Musgrave, the parent company of SuperValue, confirmed that at least 13 stores in Ireland were targeted by these remote intrusions. The attacks forced the disposal of significant quantities of fresh and frozen food. Retailers are currently working to manage the aftermath while investigating the extent of the damage to their cooling infrastructure.
5Pattern of Regional Attacks
This wave of incidents follows a similar series of attacks in France during mid-October. Chains including Carrefour, Coopérative U, and Monoprix were previously targeted, leading to massive food waste. These recurring events across Europe suggest a persistent threat actor or methodology targeting the specific operational technology used in commercial grocery refrigeration systems.
6Technical Vulnerability Context
Previous investigations into the French incidents identified outdated firmware on Danfoss refrigeration controllers as a potential entry point. CERT-FR issued alerts regarding compromised Danfoss AK-SM and AK-SC controllers following those reports. However, some retailers like Coopérative U confirmed they were not Danfoss customers, leaving the precise technical vector for the latest attacks unclear.
7Response and Recovery Efforts
Affected companies are currently implementing measures to restore store operations and ensure food safety standards. While some chains like De Laet & Van Haver reported temperature spikes without losing stock, others remain unable to provide timelines for full recovery. Retailers are prioritizing the stabilization of their cooling systems to prevent further inventory spoilage.
8Unresolved Security Challenges
Despite the widespread nature of these attacks, the identity of the perpetrators remains unknown. Retailers have not disclosed specific details regarding the intrusion methods or potential ransom demands. The ongoing vulnerability of connected refrigeration hardware highlights a critical security gap in retail supply chain infrastructure that requires urgent attention from industry stakeholders.