Hackers Turned Europe’s Supermarket Freezers Into Ovens. Three Weeks Later, They Did It Again.

Overnight into Monday, 2 November, attackers remotely changed the settings on refrigeration controls at supermarkets across Europe, warming fridges and freezers and forcing stores to throw away chilled and frozen food. The attacks hit at least seven countries — Belgium, Luxembourg, Sweden, the Netherlands, Ireland, Estonia and Finland, with further cases reported in Portugal and Italy — and echoed a similar attack three weeks earlier in which hackers seized control of cooling units at hundreds of French supermarkets. No chain reported more than several dozen affected stores, and the disruption, while widespread, remained limited store by store. But the pattern — the same kind of equipment, the same remote tampering, on the same continent, within weeks — has turned what might have looked like isolated faults into a European investigation, and a warning about how much of the food chain now depends on devices connected to the internet.

In Belgium, attackers switched cooling units into defrost mode, Stephan Moelans, chief executive of the refrigeration contractor Sabcobel, told Belgian media. Defrost mode is meant to clear ice; in these attacks it made the units heat up instead of keeping food cold. In other cases the temperature setting was raised: an ICA store in Sjöbo, in southern Sweden, said its fridges and freezers had been set to 50°C and that staff were throwing out the affected goods, while a Selver supermarket in Estonia reported a freezer set to 50°C, although its temperature rose by only about 2–3°C and the problem was resolved within about ten minutes with no products damaged. The distinction matters: a changed setting is not the same as a cabinet physically reaching that temperature, and the damage depended on how long the fault went unnoticed. At one ICA franchise store in Stockholm, the attack occurred at 2 a.m. but was only noticed hours later. "Everything is destroyed," the store's sales manager told Reuters. A butcher in Hove, south of Antwerp, told Reuters his fridges had been turned up as high as 18°C and estimated about €15,000 worth of meat was ruined.

The list of affected businesses shows how broad the net was. In Belgium and Luxembourg, Ahold Delhaize said about 40 stores were hit by what it called an "IT incident" that limited the range of fresh and frozen food; Carrefour Belgium described a cyberattack on its refrigeration affecting 15 of more than 700 stores, with very limited impact; Intermarché reported 10 to 15 stores, Spar five, and IKEA one store, in Mons. In Sweden, ICA said a limited number of stores were affected without giving a count and did not confirm a cyberattack, while Coop reported six or seven of about 800 stores tampered with without permission. In Ireland, the wholesaler Musgrave said 13 of its 223 SuperValu stores were affected and removed chilled and frozen products from sale as a precaution. In the Netherlands, at least 17 businesses, including butchers and small local shops, were attacked, according to Danfoss, the Danish maker of refrigeration controls. Not every company used the same language — some called it a cyberattack, others an IT incident or an incident — and not all of them confirmed that an attack had taken place, a caution that reflects how differently each chain describes the same kind of event.

Much of the equipment involved was made by Danfoss, as it had been in France. Danfoss said its products were involved in the latest attacks, and in the Dutch cases the systems that were hit were not on a secure network and still used default passwords, a Danfoss spokesperson told Dutch broadcaster NOS. Most Dutch shops had taken measures after the French attack, the spokesperson said, but a few had not, and those were the ones hit. Danfoss also told Belgian broadcaster VTM that the weakness lies mainly in outdated software and that customers who had not updated were affected. France's national cybersecurity agency, CERT-FR, had already warned in October that attack campaigns against Danfoss AK-SM and AK-SC controllers, as well as Copeland/Dixell XWEB systems, were probably still under way, and advised operators to take devices off the internet, check defrost schedules, restore access only through a secure VPN and change default passwords. A Belgian butcher told NOS that equipment from a second maker, Copeland, was also attacked in Belgium. In Estonia, the supplier Kitman Coldtech said attackers had reached the control computer of an older Danfoss system at the one Selver store hit — the last store it had not yet moved to a new system.

No one had claimed the attacks by Monday night, and it was not known whether they were linked to the attack in France, where police said hackers had seized control of cooling units at hundreds of supermarkets, causing fires and food losses, with about 700 victims identified by the Paris prosecutor's office. Belgium's federal prosecutor's office has opened a criminal investigation, Belgium's Centre for Cybersecurity said it was not known who was behind the attacks and that "it may never be determined", and Sweden's National Cybersecurity Centre said it was following the incidents and sharing information with agencies in other Nordic and European countries. The European Union's food and agriculture commissioner, Christophe Hansen, was reported as describing the repeated attacks as a "deliberate attempt to disrupt our food supply chain and undermine consumer confidence." Online, the reaction was as much about the design of the systems as about the attackers: a Hacker News thread on The Guardian's report of the second wave drew 433 comments debating why refrigeration controls are reachable from the internet at all, while discussion of the earlier French wave on Reddit's r/technology drew tens of thousands of upvotes. For operators, the advice now circulating is blunt, and it starts with disconnection. CERT-FR's October alert says devices that have not been compromised should be taken off the internet, have their full configuration checked — defrost schedules in particular — and be restored only through a secure VPN or protected network, with firmware updated and default passwords changed; compromised devices should be restarted or factory-reset and reconfigured before returning to service. Danfoss advised Dutch customers on 13 October to disconnect their systems and reconnect only through a secure network, and Sweden's National Cybersecurity Centre advised organisations to list which devices are connected to the internet, decide whether each one needs to be, and keep any that remain connected updated and protected with multiple layers of security. The longer-term framework is also tightening: reporting duties under the European Union's Cyber Resilience Act began on 11 September 2026, with its principal product-security obligations applying from December 2027. But as Sabcobel's Mr Moelans noted, a software update alone is not enough, because the installations need physical changes that cost money — and until those changes are made, the simplest protection remains a secure connection for managing the fridges, which most of his customers adopted only after the French attack.