Supermarkets across Belgium, Sweden and Estonia have reported cyber incidents targeting refrigeration systems, disrupting cooling operations and raising concerns about food safety and vulnerable connected devices.
Several supermarkets across Europe have reported cyber incidents targeting their refrigeration and freezer systems, raising concerns about the security of connected equipment in retail stores.
On Monday, grocery retailers Ahold Delhaize and Colruyt reported disruptions affecting cooling systems at multiple stores in Belgium and Luxembourg. Similar incidents were also reported by Swedish supermarket chains ICA and Coop, while an Estonian supermarket was reportedly affected as well.
The incidents involved unusual temperature increases in refrigerators and freezers, with some systems reportedly reaching 50 degrees Celsius. The developments have raised fresh concerns about cybercriminals targeting operational technology used in essential business infrastructure.
Ahold Delhaize and Colruyt confirmed that an IT-related incident affected refrigeration equipment at several stores overnight.
Delhaize, the Belgian supermarket chain operated by Ahold Delhaize, detected unusual temperature increases in its cooling systems on Monday. Company spokesperson Sarah De Meester said the retailer had launched an investigation into the incident.
Stephan Moelans, CEO of Belgian refrigeration company Sabcobel, which operates Delhaize's cooling systems, told Belga news agency that the incident involved a cyberattack. According to him, hackers switched the evaporators of refrigeration units into defrost mode, disrupting their normal cooling operations.
Meanwhile, Colruyt Group, which operates Spar outlets in Belgium through a franchise arrangement, reported that five of its stores experienced attacks targeting their refrigeration systems.
The latest developments follow a similar incident in France last month, when hackers reportedly gained control of refrigeration equipment at hundreds of supermarkets.
According to police information cited in reports, the attackers manipulated cooling systems and caused temperatures to rise as high as 50 degrees Celsius.
The incident reportedly resulted in fires and food losses, highlighting the potential consequences of cyberattacks on equipment responsible for maintaining safe storage conditions.
Ahold Delhaize had also reported a cybersecurity incident to Dutch police last month after identifying suspicious activity within its IT infrastructure.
However, authorities have not publicly identified those responsible for the earlier French incidents, and no group has claimed responsibility.
Cyber incidents involving refrigeration systems were also reported across Sweden.
John Billow, head of Sweden's National Cybersecurity Centre, told Reuters that the organisation was handling several cases involving cooling equipment at grocery stores across the country.
One ICA supermarket reported on social media that its refrigerators and freezers had been compromised overnight, with temperatures allegedly adjusted to 50 degrees Celsius. The store later confirmed that it had reopened.
At an ICA Baronen outlet in Stockholm, a notice informed customers that its freezers were not functioning because of a cyberattack. The store's sales manager said the incident occurred at approximately 2 a.m. and was discovered around 5:30 a.m.
ICA also acknowledged that a limited number of its stores had experienced an overnight incident affecting refrigeration and freezer operations. Separately, Swedish grocery retailer Coop informed newspaper Aftonbladet that six of its stores had faced similar problems.
The cybersecurity incidents were not limited to Western European countries. An Estonian supermarket chain also reportedly experienced an attack in which refrigeration temperatures were adjusted to 50 degrees Celsius.
Technology supplier Kitman Coldtech confirmed the development to Estonia's public broadcaster ERR. The company's CEO, Jann Mutso, said the incident had occurred that morning but declined to identify the affected supermarket chain.
The incident further highlighted the geographical spread of attacks targeting refrigeration infrastructure across European retail businesses.
The incidents have drawn attention to the increasing vulnerability of operational technology systems used in supermarkets and other commercial establishments.
Modern refrigerators, freezers, heating equipment, security cameras and alarm systems are increasingly connected to digital networks. These devices can be monitored and controlled remotely, improving operational efficiency but also creating potential entry points for cybercriminals.
Sweden's National Cybersecurity Centre chief John Billow said recent investigations had identified several operational technology devices in the country that were exposed to security risks.
He emphasised the importance of regularly updating and patching vulnerable systems to prevent potential attacks.
The incidents underline the need for businesses to strengthen cybersecurity protections not only for traditional IT networks but also for connected equipment that supports everyday operations.
Conclusion
The latest cyberattacks on supermarket refrigeration systems across Europe highlight the growing risks associated with connected operational technology. Incidents in Belgium, Sweden and Estonia have raised concerns about food safety, equipment security and potential financial losses. As supermarkets increasingly depend on remotely managed infrastructure, stronger cybersecurity measures, regular software updates and effective monitoring will be essential to protect critical store operations.