Cyberattacks disrupt more than 100 supermarket stores across Europe

More than 100 supermarket stores across Europe reported refrigeration problems on Monday after suspected cyberattacks disrupted cooling systems, forcing retailers to discard perishable food and raising concerns about the security of increasingly connected infrastructure.

Retailers in Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands and Sweden reported incidents in which temperatures inside refrigerators and freezers rose sharply. In some stores, temperatures reportedly reached 50 degrees Celsius.

The latest incidents follow a similar attack in France last month that affected hundreds of supermarkets and caused substantial food losses.

Among the affected retailers, Ahold Delhaize reported problems with refrigeration systems at dozens of its stores in Belgium and Luxembourg. Carrefour Belgium reported disruptions at around 15 of its more than 700 stores, while Colruyt said five outlets had been affected.

Swedish supermarket chain Coop confirmed that seven stores had experienced problems. ICA also reported incidents at a limited number of outlets. In Ireland, Musgrave Group, which operates SuperValu, said refrigeration systems at 13 stores had been affected.

IKEA confirmed that its store in Mons, Belgium, also experienced a refrigeration incident. The company said some food products were removed from cooling units as a precaution.

In the Netherlands, at least 17 mostly smaller shops reportedly experienced similar problems. Finnish retailer Kesko said it was investigating irregular temperatures at several stores, while an Estonian supermarket chain confirmed that hackers had accessed a computer controlling refrigeration equipment at one outlet.

The financial losses varied between retailers. A butcher in the Belgian town of Hove estimated that it lost around €15,000 worth of meat after temperatures in its refrigerators rose to 18 degrees Celsius.

The attacks forced affected businesses to inspect equipment, remove potentially spoiled products and restore refrigeration systems. Several retailers said their systems had been brought back online, although investigations into the incidents were continuing.

No group has claimed responsibility for the attacks, and authorities have not established whether all the incidents were part of a coordinated campaign.

A vulnerability in connected equipment

The attacks have drawn attention to the security of operational technology, which includes the hardware and software used to monitor and control physical equipment.

Unlike conventional cyberattacks targeting financial accounts, websites or personal information, attacks on operational technology can directly disrupt physical processes. Refrigeration systems, industrial machinery and other infrastructure increasingly rely on internet-connected controllers that allow operators and service providers to monitor and adjust equipment remotely.

In the latest incidents, some affected systems were supplied by Danish refrigeration manufacturer Danfoss, whose equipment was also involved in the October attacks in France.

Following the French incidents, Danfoss said much of the affected equipment consisted of older products that had reached the end of their service life and no longer received software or security updates. The company had previously recommended that customers update supported systems and replace obsolete equipment.

In Sweden, the head of the country’s National Cyber Security Centre, John Billow, said authorities had identified a significant number of exposed operational technology devices that needed updating or security patches, Reuters reported.

Cybersecurity specialists say retailers are particularly exposed because supermarket chains operate large networks of refrigeration controllers, building-management systems, access controls and payment equipment.

Tom Hegel of cybersecurity firm SentinelOne told Reuters that the absence of financial demands in the supermarket incidents could indicate sabotage rather than conventional extortion.

Patrick Lamplmair of cybersecurity firm Tributech also warned that internet-accessible refrigeration controllers could be exploited repeatedly if known vulnerabilities remained unaddressed.

Food supply chains under pressure

The repeated incidents have prompted concern among European authorities about the potential consequences of cyberattacks on food infrastructure.

Christophe Hansen, the European Union’s commissioner for agriculture and food, described the attacks as a deliberate attempt to disrupt food supply chains and undermine consumer confidence.

The incidents in France had already prompted investigations by national cybersecurity authorities and law enforcement agencies. The Paris prosecutor’s office opened an investigation into the October attacks, while the French government instructed its national cybersecurity agency to examine the incidents.

The latest wave has expanded the geographical reach of the problem, although investigators have yet to establish a common perpetrator or determine whether the attacks were connected.

For retailers, the incidents demonstrate how a relatively limited breach of digital systems can translate into immediate physical and financial damage. Compromising a refrigeration controller does not necessarily require access to a company’s payment systems or customer databases, yet it can render large quantities of food unsafe for consumption.