Supermarket Freezer Cyber Attack: Units Hacked to 50C in Seven Countries

Supermarket chains in seven European countries found fridges and freezers pushed as high as 50C (122F) overnight on Monday, and several confirmed they had been hacked. This supermarket freezer cyber attack follows a larger one in France last month. Any food retailer, in Cyprus or Belgium, whose temperature controllers are reachable from outside the store could find its cold shelves empty before staff arrive.

What happened to supermarket freezers on Monday?

Overnight into Monday, attackers changed the settings on store refrigeration in Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden. Some cabinets were reportedly driven to 50C (122F), and several retailers confirmed a hack rather than an equipment fault. Seven countries on one night point to a shared method, not seven unrelated failures.

Nobody has claimed responsibility, and no ransom demand has surfaced. Affected sites ranged from a single outlet in Estonia to dozens of Delhaize shops. North-east of Brussels, one shop posted a sign: “Due to cyberattacks, there will be no products on the refrigerated or freezer shelves. We offer our sincere apologies.”

How does this compare with the French supermarket attack?

Monday’s wave looks like a multi-country repeat of last month’s attack in France, although no investigator has officially linked the two. In France, controllers in as many as 700 supermarkets were manipulated, pushing thousands of freezers, fridges and chiller cabinets from as low as -27C to well over 50C.

The French attack caused fires and food losses in the tens of millions of euros, with individual stores losing from tens of thousands of euros to more than €130,000. Intermarché, Coopérative U, Carrefour, Leclerc and Monoprix were among the chains hit.

Most targeted controllers came from Danish manufacturer Danfoss, which said it had identified some security flaws last year and had “long recommended” that customers install updates. France’s cybersecurity agency, ANSSI, later found that controllers from two other, unnamed suppliers were also targeted.

The Paris prosecutor’s office has opened a formal investigation, and Prime Minister Sébastien Lecornu instructed ANSSI to investigate. No vendor or vulnerability identifier has been publicly named for Monday’s incidents.

Which retailers reported disruption this time?

Belgium produced the most detail. Ahold Delhaize said dozens of its supermarkets in Belgium and Luxembourg were hit, without specifying the cause; last month it reported a similar incident to Dutch police. Le Soir listed five Spar outlets, Shop & Go stores at Q8 service stations and some Proxy Delhaize mini-markets among those affected.

Sabcobel, which operates Delhaize’s refrigeration, gave the most useful technical detail. CEO Stephan Moelans told Le Soir his team began mobilizing technicians at 1am and spent “all night and morning disconnecting the affected installations.” He told Belga it was a cyber-attack that switched the units’ evaporators to defrost mode.

• Belgium, other chains: Colruyt reported five shops, Intermarché 15 and Carrefour Belgium about 15 of its 700. Carrefour spokesperson Mich Vergauwen said: “It’s a cyber-attack, there is no other reason.” Ikea’s Mons store pulled some food after freezer temperatures rose suddenly.
• Ireland: SuperValu said one unnamed refrigeration model was affected in 13 of its 223 shops and removed chilled and frozen goods from sale.
• Netherlands: at least 17 mainly small local shops, according to NOS.
• Estonia: refrigeration supplier Kitman Coldtech told ERR that attackers reached a computer controlling the system at one Selver outlet and set the temperature to 50C. CEO Jann Mutso said it was dealt with within minutes, with no significant damage.
• Sweden: Coop told Aftonbladet six shops were hit; ICA confirmed only “a limited number of stores.” Its Sjöbo store said fridges and freezers had been set to 50C, and a Stockholm store blamed a 2am cyberattack and said everything was destroyed.
• Finland: Helsingin Sanomat reported Kesko stores investigating similar problems.

SuperValu’s figure matters most to defenders: one model failing in about 6% of an estate points to a shared exposure, not 13 separate local mistakes.

How does a defrost command spoil a store overnight?

The attack abuses a function the equipment is built to perform. A defrost cycle warms the evaporator to clear ice, and the controller normally ends it after a short interval. Force units into defrost, or push setpoints far above normal, and cabinets keep warming until someone intervenes. If the change goes through the controller’s normal interface, there may be no malware to find.

An empty store overnight does the rest: a cabinet climbing toward 50C ruins stock long before staff arrive. In Estonia, where the response took minutes, Kitman Coldtech reported no significant damage. With no data stolen and only legitimate values changed, the warning has to come from the temperature itself, delivered to a person who can act at night.

Why are analysts calling this sabotage, not extortion?

Analysts call it sabotage because no one has asked for money. SentinelOne’s Tom Hegel told Reuters: “Retail is an easy target because retail chains run enormous estates of refrigeration controllers, building management systems, door access panels and point-of-sale gear.”

Patrick Lamplmair of Tributech warned: “Thousands of these controllers were still reachable from the internet after the French attack.” He expects attacks to continue until the method stops working, because it is cheap, does immediate damage, and many refrigeration systems still carry known, unfixed flaws.

EU food and agriculture commissioner Christophe Hansen called the repeated attacks “a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it.” European authorities have feared state-backed hybrid attacks on remotely controlled devices since Russia’s 2022 invasion of Ukraine, but no one has attributed either wave to a state.

Still unknown: how the attackers got in (exposed controllers, vendor platforms or stolen credentials) and whether one operator ran both waves.

What should Cyprus and EU food retailers check this week?

First, establish whether anyone outside a store can reach its refrigeration and building controllers, and make sure a warming cabinet alerts someone at 2am. Until Danfoss, ANSSI or national CSIRTs publish specifics, assume the method works on any controller reachable from outside the store.

John Billow, head of Sweden’s national cybersecurity centre, told Reuters the country had “quite a lot of exposed operational technology devices” that needed updating or patching. The same equipment runs in Cyprus supermarket groups, cold stores, food distributors, hotels and shipping firms with their own cold rooms.

• Map every path in. Check store routers and firewalls for port forwards to controllers, then vendor VPNs, remote-support gateways, cloud management portals and flat links to the office network.
• Patch. Ask each contractor which firmware runs in each store and when it was last updated.
• End shared vendor logins. If one contractor password opens every store, one leak can cause a chain-wide outage. Require per-site accounts and on-demand remote sessions.
• Segment. Following the IEC 62443 zones-and-conduits model, put refrigeration in its own zone with only defined, logged outbound traffic.
• Alarm independently. A standalone temperature probe that texts a phone still works when the controller has been reconfigured.
• Plan isolation. Sabcobel’s fix was physical disconnection. Decide in advance who may isolate equipment, how to keep safe local control, and where stock will go.

Practitioner’s note. In OT and ICS penetration testing, the weak point is usually a contractor’s remote-access gateway with one login covering many sites, not the controller itself. Test that route first, and gather information passively, because some industrial devices respond badly to aggressive scanning.

If you are hit, preserve the controller’s audit trail (setpoint and defrost changes, logins, source IPs, timestamps) before restoring configurations, and compare it with firewall, VPN and vendor-platform logs to find the attacker’s route. An external network penetration test scoped to store sites shows what an attacker can see.

For stock, keep each cabinet’s HACCP temperature records and log the quantities and disposal of everything discarded. Return nothing to sale unless your food safety lead confirms it stayed within limits. Those records support insurance claims and inspections, and help investigators pin down when the attack began.

Does NIS2 apply to a supermarket freezer cyber attack?

Not automatically. Annex II of the NIS2 Directive lists food businesses engaged in wholesale distribution and in industrial production and processing, so a chain’s logistics or production arm may be in scope even when its shops are not. Our NIS2 entity self-check helps you settle this before an incident.

Article 23 sets the reporting clock: an early warning within 24 hours of becoming aware of a significant incident, a notification within 72 hours and a final report within one month. The clock does not wait for attribution. In Cyprus, reports go to the Digital Security Authority, which also hosts the national CSIRT-CY.

FAQ

Which European countries had supermarket freezers hacked this week?

Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden reported incidents overnight into Monday, a month after a larger attack on French supermarkets.

Did attackers demand a ransom from European supermarkets?

No ransom or extortion demand has been reported. SentinelOne's Tom Hegel said this points to sabotage rather than extortion.

Are Danfoss refrigeration controllers involved?

Most controllers targeted in France were Danfoss units, and ANSSI found two other unnamed suppliers were also targeted. No vendor has been publicly named for Monday's incidents.

What should retailers do if store freezers are switched to defrost?

Isolate the equipment while keeping safe local control, preserve controller logs before restoring settings, and keep HACCP records of any stock you discard. Then review every remote path to the controllers, including vendor access.

If your stores, cold rooms or distribution sites run remotely managed refrigeration, our NIS2 compliance penetration testing can map who can reach those controllers before someone else does.