Supermarket fridge cyberattack incidents spread across Europe on Monday, as hackers remotely cranked up the temperature in refrigeration and freezer units at dozens of stores from Sweden to Belgium. Retailers were forced to discard large quantities of spoiled food in an episode that closely resembled a similar assault on French supermarkets just weeks earlier.

Who Was Hit

The attack struck some of the continent’s best-known grocery names. Ahold Delhaize and Colruyt reported disruption at stores in Belgium and Luxembourg, while Swedish chains ICA and Coop confirmed their refrigeration systems had been tampered with. IKEA said at least one of its Belgian outlets was affected and could not rule out problems elsewhere.

Carrefour, which suffered heavily in last month’s French attack, said 15 of its 700 Belgian stores were impacted. Colruyt Group, which operates SPAR franchises in Belgium, reported five shops with compromised fridge systems. Coop said seven of its 800 Swedish stores had been hit. In Ireland, wholesaler Musgrave disclosed that 13 SuperValu stores were affected, prompting it to pull certain chilled and frozen items from shelves.

Scenes From the Shop Floor

At an ICA franchise in Stockholm, sales manager Engla Ingwall described the damage as total. The attack occurred at 2am local time but went unnoticed for hours, by which point freezer temperatures had climbed to 50 degrees Celsius. Everything inside was ruined.

South of Antwerp, Luc De Laet, who owns the butchery chain De Laet & Van Haver, was woken at 3:30am by a staff member reporting trouble. He arrived to find his fridges set as high as 18 degrees. He estimated the loss at around 15,000 euros worth of meat and said the experience was frightening, with attackers able to reprogram temperature controls from afar. He had contacted police but was unsure whether an investigation was underway, and urged authorities to recognise that something serious was unfolding.

A Pattern Emerging

Monday’s incidents follow a major attack in France last month, when police said hackers took control of cooling systems at hundreds of supermarkets, triggering fires as well as food losses. Ahold Delhaize had also reported a separate cybersecurity incident to Dutch police in October.

No individual or group has claimed responsibility for any of the attacks. Reuters was unable to determine who carried out Monday’s operation or whether it was connected to the French episode.

The Hybrid Threat Question

The timing and nature of the attacks have intensified concern among European officials about hybrid threats to critical infrastructure, a worry that has grown since Russia’s 2022 invasion of Ukraine. Moscow has consistently denied any role in sabotage or hybrid operations.

Katrien Eggers, spokesperson for Belgium’s Centre for Cybersecurity, said the perpetrators were unknown and might never be identified. She expressed concern about the rising frequency of such incidents, noting that artificial intelligence now allows sophisticated actors to find and exploit weaknesses in virtually any IT system.

The European Commission weighed in as well. Agriculture Commissioner Christophe Hansen described the attacks as a calculated effort to disrupt the food supply chain and shake consumer confidence, calling the repeated nature of the incidents deeply worrying.

Why Refrigerators Are Vulnerable

The attacks highlight a broader shift in how commercial equipment operates. Devices that were once purely mechanical, from fridges and heating systems to security cameras and alarms, are now connected to networks and can be monitored and adjusted remotely. That convenience creates openings for attackers.

Some of the affected units relied on temperature control technology from Danish manufacturer Danfoss, whose products were also targeted in France. The company said it had been working with customers to roll out fixes. Coop confirmed Danfoss was among its suppliers.

Sabotage, Not Extortion

Tom Hegel, a researcher at cybersecurity firm SentinelOne, said attacks of this kind usually stem from one of three motives: extortion, political messaging or state-directed operations. The lack of any ransom demand in the recent cases, he said, suggests the goal is sabotage rather than profit.

Retail, Hegel explained, makes an attractive target because chains operate vast networks of refrigeration controllers, building management systems, access panels and checkout equipment. Tracing intruders is difficult; someone who logs into an exposed control panel leaves almost no trace, and from the defender’s perspective a bored teenager and a foreign intelligence agency can look identical.

Retailers Respond

Musgrave said its monitoring systems flagged the problem and it acted immediately, with an investigation ongoing. ICA’s spokesperson said only a limited number of stores were affected. Other chains issued similar statements acknowledging the incidents while emphasising that the scale was contained.

Yet even a handful of compromised stores can mean significant losses and, more importantly, a chilling demonstration of how easily everyday infrastructure can be turned against its operators.

The Bigger Picture

Beyond the immediate financial damage, the attacks raise uncomfortable questions about the security of systems that most people never think about. If refrigeration controllers can be manipulated remotely, so too can countless other connected devices that underpin daily life.

European authorities now face the dual task of identifying those responsible and hardening the infrastructure against repeat attacks. For retailers, the lesson is stark: the fridge in the back room is now part of the cybersecurity perimeter, and leaving it exposed carries real consequences.

As De Laet put it, the message to governments and businesses alike is simple: wake up, because something is clearly going on.