In Belgium, Ahold Delhaize and Colruyt reported an IT incident affecting dozens of stores. Sarah De Meester, a spokesperson for Ahold Delhaize, stated that the company detected unusual temperature increases in its refrigeration systems and is investigating the cause. Stephan Moelans, CEO of Sabcobel, the company managing Delhaize’s refrigeration, told news agency Belga that hackers had switched the units’ evaporators to defrost mode. Colruyt Group, which operates Spar stores in Belgium, confirmed that five of its stores had suffered attacks on their refrigeration systems. Belgian newspaper Le Soir reported that dozens of Delhaize and Carrefour stores were affected.
In Sweden, major chains ICA and Coop reported similar disruptions. Gustaf Nilsson, a press officer for ICA Group, told Swedish news agency TT that a limited number of stores were affected by an incident overnight that impacted their refrigeration and freezer systems. ICA Kvantum in Sjöbo stated on Facebook that a cyberattack caused the refrigeration problems, with temperatures inside fridges and freezers rising to 50°C. The chain also reported that ICA Hägerstensåsen in Stockholm was affected. Coop confirmed that six of its stores in central Sweden were similarly impacted. Cybersecurity consultant Emil Olofsson of Integrity 360 told TT that temperatures reached 80°C in some Swedish cases and that several units caught fire, a figure that differs from the 50°C reported by police and some store managers.
The attacks appear to utilize a specific technical method: triggering the forced defrost function of refrigeration equipment in a continuous mode. Normally, supermarket freezers undergo a short defrosting period overnight to clear ice buildup, during which temperatures rise slightly. In these incidents, attackers remotely forced the units to heat up and remain hot, with settings reportedly at 50°C. In some locations, staff arriving in the morning encountered “a wave of heat” from the open units, and small fires broke out.
This is the second major wave of such attacks in Europe. In mid-October, a large-scale cyberattack hit the refrigeration systems of hundreds of French supermarkets. According to the BBC, more than 400 stores out of approximately 15,000 in France were affected. The attack targeted software provided by Danish engineering firm Danfoss, which many retailers use to manage their cold units remotely. Danfoss stated that the affected cold units were older models whose security software could not be updated to ward off a risk they had identified, adding that they had “long advised” businesses to keep supported systems up to date. French prosecutors have opened a specific cyber-crime investigation, describing it as a “large-scale cyber-attack affecting the refrigerators of several major food retail chains across France.”
The financial and operational impact of these attacks is significant. In France, fresh and frozen food estimated to be worth millions of euros was spoiled. Two supermarkets in the Alsace region alone reported losses of €270,000. Retailers such as Intermarché and Netto threw away all affected food to avoid health risks. In Sweden and Belgium, staff are working to restock shelves and restore operations, though the full extent of the damage is still being assessed.
European Food Commissioner Christophe Hansen condemned the recent incidents, stating in a post on X: “Food security requires more attention at all levels. Because the weaponisation of food has become a reality.” The repeated targeting of older, unpatched industrial systems underscores a critical vulnerability in the supply chain infrastructure that supports daily food consumption across the continent. As retailers work to restore normal operations, the incidents highlight the urgent need for updated security protocols and the retirement or isolation of legacy hardware in critical food distribution systems.
