The attacks involved the remote manipulation of fridges and freezers, causing internal temperatures to spike. At least one store reported temperatures reaching up to 50°C (122°F), rendering stored food unsafe for consumption. While the specific technical method involves the exploitation of control units connected to the public internet, the immediate impact was physical: melted and wilted food products found in morning inspections.
Belgium emerged as the epicenter of the latest wave of disruptions. Ahold Delhaize, a Dutch supermarket group, confirmed that dozens of its Delhaize stores in Belgium and Luxembourg were affected. The company stated that the incident resulted in the discarding of food but that stores had returned to full operation. In France, Carrefour reported that 15 of its Belgian-based stores were targeted. Intermarché, another major French retailer, disclosed that 15 of its 153 stores in Belgium were impacted. An Intermarché spokesperson noted that while security measures allowed for quick containment in most cases, some stores suffered stock losses. The company added that the bulk of the attack appeared to target other sector players, notably Carrefour and Delhaize.
Other major retailers reported similar disruptions. IKEA confirmed a cyber incident affected refrigerators and freezers at its Mons store in Belgium between Sunday and Monday, though the store remained open. The company is currently inspecting the affected equipment and checking installations across its other Belgian locations. Colruyt Group stated that five of its Spar stores in Belgium were targeted. In Sweden, ICA, the country’s largest grocery retailer, informed customers of incidents at a “limited number of stores,” noting these were on networks outside ICA’s central systems. Disruptions were also reported at Finnish supermarket Kesko, Irish chain Supervalu, and Estonian grocer One Selver.
Security experts indicate that the sophistication of the attack is low, relying on long-standing vulnerabilities in industrial control systems. Fredrik Blix, a strategic cybersecurity advisor for Visente AB, explained that the control units for these refrigerators sit directly on the public internet with built-in support logins. Research published in August revealed that passwords for these systems could be obtained on the same day. Although the vendor patched the vulnerability in August, Blix noted that thousands of units never received the update, and the oldest models cannot be updated at all.
This incident follows a series of similar attacks in recent months. In October, hundreds of French supermarkets were targeted, causing fires, overheating fridges, and food spoilage. Les Mousquetaires, the owner of Intermarché, estimated damages in the millions of euros at that time. European Commissioner for Agriculture and Food Christophe Hansen commented on the October attacks, stating that “food security requires more attention at all levels because the weaponization of food has become a reality.” Additionally, in late August, freezer malfunctions occurred at six U.S. military bases, which the Pentagon is now treating as a suspected hack while coordinating with French authorities.
Rafe Pilling, Senior Director of Threat Intelligence at Sophos Counter Threats Unit, told CNBC that there is no evidence artificial intelligence has played a role in these specific attacks, although criminals are using AI elsewhere to speed up the scale of cyber operations. The attacks have not yet been claimed by any group, and investigations are ongoing. Blix suggested that the lack of a ransom note or public claim rules out typical ransomware crews. He posited two likely motivations: either the actor is exploiting the vulnerability simply because they can, or the attacks are intended to create unease in Ukraine-supporting countries without leaving digital fingerprints. The silence surrounding the attribution remains a critical unresolved question for European security agencies.
