Cyberattacks Hit More Than 40 European Supermarkets Through Refrigeration Systems

Supermarkets across several European countries have experienced suspected cyberattacks that remotely manipulated refrigeration systems, causing temperatures inside refrigerators and freezers to rise above 40 degrees Celsius.

The incidents reportedly affected more than 40 stores across seven countries, resulting in hundreds of thousands of euros worth of spoiled food.

Initial reports indicate that the attacks occurred during the early hours of Monday morning and targeted internet-connected refrigeration management systems.

Supermarkets belonging to Delhaize, Carrefour, and Spar were among those affected in Belgium and Luxembourg. Sweden’s ICA and Coop chains also reported incidents, while Irish wholesaler Musgrave confirmed that 13 SuperValu stores had been impacted.

Additional incidents were reported in the Netherlands, Estonia, and Finland.

In some locations, refrigeration temperatures reportedly increased dramatically without authorization. Store managers received warnings about sudden temperature changes, while businesses were forced to deal with damaged stock and operational disruption.

The incidents came only weeks after a similar cyberattack affected French supermarkets in October, when attackers reportedly manipulated refrigeration systems to raise temperatures to approximately 50 degrees Celsius.

Although investigators have not confirmed whether all incidents are connected, refrigeration industry specialists believe attackers may have exploited similar weaknesses.

Cybersecurity experts warn that internet-connected industrial systems can become attractive targets when they lack proper authentication and security protections.

Research from Forescout identified approximately 12,976 internet-exposed refrigeration service observations across 99 countries, highlighting the potential scale of the problem.

Experts recommend removing direct public internet access from refrigeration equipment, implementing strong authentication, eliminating default passwords, and regularly updating supported systems.

They also emphasize that industrial equipment should include built-in safety restrictions to prevent unauthorized commands from triggering dangerous temperature changes.

The attacks demonstrate that cybercriminals do not always need to steal information or demand ransom payments to cause serious damage. Manipulating connected physical systems can disrupt businesses and destroy valuable products within hours.