Never Miss an Update!
Receive personalised weekly email newsletters with industry news curated just for you.
Supermarket operators across Sweden, Belgium, Luxembourg, Ireland, and Estonia have experienced widespread technical disruptions across in-store refrigeration and freezer systems following suspected cyber-attacks, forcing several retailers to condemn and dispose of affected chilled and frozen inventories.
The incidents, which occurred on Monday, represent the second major cross-border attack targeting food retail infrastructure in recent weeks. The breach follows a coordinated attack in France last month, where threat actors gained unauthorised remote access to cooling installations across hundreds of supermarkets and independent grocers, deliberately manipulating temperature setpoints and placing perishable food stocks at risk.
The cross-border incidents underline growing operational vulnerabilities surrounding connected Internet of Things (IoT) hardware and building management systems within modern grocery retail, where remote access controls used for maintenance and energy optimisation can expose physical cold chains to remote sabotage.
Impact Across European Grocery Stores
The operational fallout has impacted several prominent European supermarket groups across varying store counts:
Sweden (ICA Group & Coop): ICA Group confirmed that a limited number of its stores suffered overnight disruptions targeting chilling and freezing equipment. At an ICA Kvantum supermarket in Sjöbo, southern Sweden, digital temperature controllers were remotely altered to heat cooling units to 50°C, requiring in-store teams to dispose of all compromised perishable goods. Separately, Swedish cooperative retailer Coop reported cooling failures across six branches in central Sweden.
Belgium (Delhaize & Carrefour): Retailer Delhaize reported an IT incident affecting refrigeration machinery across several dozen stores, leading to temporary product availability shortages across fresh and frozen categories. The group confirmed that central distribution centres remained unaffected and delivery schedules continued without interruption. French grocery multinational Carrefour confirmed that 15 of its more than 700 Belgian stores suffered cooling disruptions from the cyber attack, characterising the overall trading impact as extremely limited.
Luxembourg: Delhaize confirmed that the digital disruption extended beyond Belgium into neighbouring Luxembourg, affecting cooling infrastructure across four of its operational supermarket sites.
Ireland & Estonia 🇪🇪: Supermarket operators and refrigeration engineering specialists across both markets registered system interference and irregular temperature excursions across retail display cabinets and back-of-house cold stores.
Cold Chain Vulnerabilities and Food Safety Risks
In modern high-volume food retail, individual display fridges, chilled multidecks, and walk-in freezers are linked to central digital building management systems. These centralised controllers automate temperature setpoints, manage cyclic defrost schedules, and trigger telemetry alarms if thermal thresholds are breached.
To facilitate remote diagnostics and emergency servicing, commercial refrigeration networks are frequently connected to external internet networks by third-party maintenance contractors. When unauthorised users breach these network interfaces, attackers can manipulate software parameters to disable compressors, trigger thermal defrost cycles, or elevate cabinet temperatures.
Temperature excursions create acute operational challenges for grocery store teams. Chilled proteins, dairy lines, ready meals, and frozen foods that rise above legal food hygiene safety thresholds face rapid microbial growth, requiring total product write-offs to protect consumer health.
Beyond immediate inventory loss, unplanned thermal spikes place mechanical stress on industrial compressors, creating potential hardware burnout and secondary equipment maintenance costs.
Operational Resilience Across Food Retail
The coordinated disruptions across five national grocery markets follow an October incident in France, where hackers compromised legacy remote-access cooling controllers across hundreds of supermarket locations.
The recurrence of attacks highlights the critical need for food and beverage retailers to strengthen cybersecurity protocols across their physical operational technology (OT) networks. Historically, enterprise cybersecurity investments have prioritised protecting corporate finance data, e-commerce storefronts, and digital point-of-sale (EPOS) registers. However, as store estates deploy connected smart-grid technology to optimise commercial energy consumption, facility equipment has emerged as a high-risk operational vector.
Retail risk specialists indicate that securing food supply chains will require grocery operators to audit legacy refrigeration controllers, enforce multi-factor authentication across third-party facility maintenance links, isolate industrial IoT systems from public internet connections, and install local analogue overrides to protect temperature-controlled food stocks.
