Supermarket Cyberattack Heats Freezers in Belgium and Sweden

A suspected supermarket cyberattack hit refrigeration systems at dozens of grocery stores in Belgium, Luxembourg and Sweden overnight from November 1 to November 2, pushing freezer temperatures as high as 50°C (122°F) and forcing stores to throw away large amounts of food. It comes only three weeks after a similar attack on supermarket fridges in France, and no group has claimed responsibility.

Which Stores Were Hit by the Supermarket Cyberattack

In Belgium, Delhaize said an “IT incident” affected refrigeration and freezer systems at around 40 stores in Belgium and Luxembourg, while Carrefour Belgium reported problems at 15 locations and Colruyt Group said five Spar shops were hit. According to The Brussels Times, store managers were warned around 4 a.m. that temperatures were rising, and many fridges climbed to about 15°C. Some managers called in refrigerated trucks to save their stock.

The Antwerp butcher chain De Laet and Van Haver said alarms went off around 3 a.m. after its settings were changed remotely. “The evaporators had been switched to defrost mode, causing the components inside the refrigerators to heat up,” operations team leader Werner Muylle told Belga. The CEO of Sabcobel, the refrigeration company that runs Delhaize’s systems, also described the incident as a cyberattack.

In Sweden, ICA said a “small number of ICA stores operating outside ICA’s central network” were affected, and Coop told the BBC that seven of its roughly 800 stores were hit. One ICA store wrote that its refrigerators and freezers had been “hacked overnight” and set to 50 degrees. The BBC also reported that 13 SuperValu shops in Ireland were affected, and a Delhaize branch in Hoeilaart, Belgium, estimated its losses at €100,000.

Reuters reported that an Estonian supermarket chain was also hit, according to technology supplier Kitman Coldtech. John Billow, head of Sweden’s national cybersecurity center, said the agency had recently found “quite a lot of exposed operational technology devices in Sweden” that needed to be updated or patched.

A Repeat of France’s Fridge Attack

The method matches the attack that hit French supermarkets on the night of October 11 to 12, when hackers remotely switched cooling units into defrost cycles at chains including Intermarché, Carrefour, Monoprix and Coopérative U. French authorities put the number of affected stores at 500 to 700, and the Paris prosecutor reported food losses and fires, according to The Guardian. France’s cybersecurity agency ANSSI linked that breach to refrigeration controllers using Danfoss, Copeland and Dixell software, and Danfoss said many affected units had reached end of life or ran outdated firmware.

Why It Matters

Store refrigeration is now usually monitored and controlled over the internet, and older controllers that are left exposed online can be changed by anyone who finds them. Unlike ransomware, these attacks have come with no ransom demand, which points to sabotage or disruption rather than money. They follow other attacks on civilian systems, such as the hack of Ukraine’s air raid alert app this weekend.

Connected appliances have caused trouble before even without attackers, as seen when a Samsung smart fridge update caused system failures around the world. For retailers, the fix is simpler than the damage: take refrigeration controllers off the open internet, update firmware, replace unsupported units and set up independent temperature alarms.

Investigators in Belgium and Sweden have not said whether Monday’s incidents are linked to the French attack. Both countries’ national cybersecurity agencies said they were monitoring the situation, as attacks on everyday infrastructure continue across Europe, including the recent spyware campaign against German lawmakers.