Supermarket chains in Sweden, Belgium, and Luxembourg have reported incidents where refrigerator and freezer temperatures rose unexpectedly overnight. These events follow a large-scale cyber-attack in France earlier in the year, which resulted in millions of euros in food losses. In the recent incidents, retailers such as Coop and ICA in Sweden, and Ahold Delhaize in Belgium and Luxembourg, confirmed that their cooling systems were impacted by 'IT incidents' or 'refrigeration and freezer system' issues, prompting immediate technical intervention to disconnect affected units from the power grid.
This image illustrates the physical impact on retailers like ICA in Sweden who reported cooling system issues.
The mechanism behind these attacks involves the exploitation of internet-connected controllers used to manage industrial cooling systems. In the French incident, hackers seized control of units at up to 700 supermarkets, remotely overriding settings to push temperatures from as low as -27C to well over 50C. The attackers were able to disable alarm systems before manipulating thermostats or extending defrost programs. Many of these systems use controllers—such as those supplied by the Danish company Danfoss—that are networked to allow for remote maintenance and failure alerts. While Danfoss had identified security flaws and recommended updates, the accessibility of these systems to the public internet remains a primary point of vulnerability.
The consequences of these breaches are both financial and physical. The French attack led to the disposal of vast quantities of fresh meat, dairy, and frozen products, with some individual stores reporting losses exceeding €130,000. In some cases, the temperature spikes even resulted in fires. These incidents underscore a significant trade-off in modern retail: while connecting cold aisles to the internet provides the convenience of remote monitoring and rapid troubleshooting, it also expands the attack surface, allowing remote actors to cause widespread physical damage and inventory loss. It remains unclear whether the current wave of attacks stems from the same actors as the French incident or if they are independent exploits of similar hardware vulnerabilities.