According to reports by Al Jazeera Staff and Reuters, published by Al Jazeera, and The Guardian, suspected cyberattacks disrupted supermarket refrigeration systems in at least seven European countries on November 2, with temperatures in some refrigerators and freezers rising to 50°C (122°F). Retailers in Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands and Sweden reported incidents affecting cooling equipment, forcing some stores to remove chilled and frozen products from sale.
In Belgium, refrigeration service provider Sabcobel confirmed that attackers had switched refrigeration unit evaporators into defrost mode. The company deployed technicians overnight to disconnect affected installations. Ahold Delhaize reported disruption at dozens of stores in Belgium and Luxembourg, while Carrefour Belgium, Colruyt and Intermarché also reported refrigeration problems. In Sweden, ICA and Coop confirmed incidents, with Coop reporting six affected stores.
Ireland’s SuperValu reported that a specific model of refrigeration system was affected by a cyber incident at 13 of its 223 stores. In Estonia, refrigeration supplier Kitman Coldtech said attackers accessed a computer controlling supermarket refrigeration equipment and raised the temperature setting to 50°C (122°F). The company responded within minutes and reported no significant damage.
The incidents follow a cyberattack in France in October that affected refrigeration controllers in as many as 700 supermarkets. Attackers remotely changed temperature settings on refrigerators, freezers and chilled display cabinets, in some cases from -27°C (-16.6°F) to more than 50°C (122°F). The attack caused fires and food losses estimated at tens of millions of euros. Danish manufacturer Danfoss, whose controllers were among those compromised, said it had previously identified security vulnerabilities and recommended that customers install updates.
Sweden’s national cybersecurity centre said it was responding to multiple incidents and had identified numerous internet-exposed operational technology devices requiring updates or patches. Cybersecurity specialists also warned that refrigeration controllers remained accessible online after the French attack. No group has claimed responsibility for either incident, and authorities have not identified the attackers.
European Commissioner for Agriculture and Food Christophe Hansen described the attacks as “a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it”.
