Cyberattacks Disrupt Supermarket Refrigeration Systems Across Europe

Refrigeration controls have become a new pressure point for grocery retailers: overnight IT incidents sent temperatures climbing in stores across Europe, disrupting cold storage in Belgium, Luxembourg, Sweden and Estonia. Several companies described the events as cyberattacks, while investigations continue into the incidents and their scope. The reports raise a practical question for store operators: how much control over essential equipment sits behind systems that can be reached through a retailer’s wider IT environment? The answer isn’t yet clear in these cases, but the consequences were visible in stores before investigators had established who was responsible.

Cold storage systems targeted

Dutch retailer Ahold Delhaize and Belgian chain Colruyt reported problems in stores in Belgium and Luxembourg. Ahold Delhaize spokesperson Sarah De Meester said the company detected temperature increases in its cooling systems on Monday and is investigating. The retailer had reported suspicious activity in its infrastructure to Dutch police the previous month. That earlier report provides context, but it doesn’t establish a connection to the refrigeration incident; the company’s investigation is still under way.

Stephan Moelans, chief executive of refrigeration operator Sabcobel, told Belgian news agency Belga that attackers switched evaporators in Ahold Delhaize’s units into defrost mode. Sabcobel operates the systems for the retailer. If that account is confirmed, it points to a direct way an attacker could interfere with temperature control: changing how the equipment runs rather than simply disrupting a retailer’s office systems. Moelans’ office declined to comment when contacted by Reuters.

Colruyt Group, which operates Spar stores in Belgium through franchises, said refrigeration systems were attacked in five shops. Swedish retailer Ikea also blamed a cyberattack for a refrigeration issue at one Belgian store and said some food had been taken off sale. The reports show that an equipment problem can quickly become a retail operations problem: staff may have to assess affected stock and manage the store while the cause is still being investigated. That’s a costly kind of uncertainty even before the technical details are settled.

The reports follow an incident in France last month. Police said hackers took control of cooling equipment at hundreds of supermarkets, driving temperatures as high as 50 degrees Celsius and causing fires and food losses. That episode gives the current reports a troubling precedent, though it doesn’t prove that the incidents share a cause or method. Similar systems can create similar vulnerabilities, and investigators will need evidence from each case to establish whether these events are connected.

Swedish grocers report similar disruptions

Sweden’s national cybersecurity centre is working on several incidents involving grocery store refrigeration, its head John Billow told Reuters. ICA said a limited number of its stores experienced an overnight incident affecting refrigerators and freezers. One ICA store reported online that temperatures had been changed to 50 degrees. That figure is a reported setting, not a full account of the equipment’s condition or the duration of the disruption, so the operational impact may differ from store to store.

At ICA Baronen in Stockholm, a store notice said all freezers had failed because of a cyberattack. The sales manager said the incident began at 2am local time and was discovered at 5:30am. Swedish grocery group Coop told local media that six of its stores had experienced similar problems; it did not immediately respond to a request for comment. The overnight timing matters: staff may discover a control failure only after equipment has been running unattended for hours. A short gap between detection and response can make a meaningful difference to what a store needs to do next.

Billow said authorities had recently identified many exposed operational technology devices in Sweden and had stressed the need to update or patch them. His comments point to a practical challenge for retailers: equipment built for physical operations is increasingly connected to systems that can be monitored and controlled remotely. Those links can help operators manage sites, but they also mean that security work has to account for equipment outside conventional office IT. The incident reports don’t explain how the affected systems were accessed, so the precise weaknesses remain unknown.

An Estonian supermarket chain was also affected, with its refrigeration temperatures reportedly set to 50 degrees, technology supplier Kitman Coldtech told public broadcaster ERR. Kitman chief executive Jann Mutso said the incident had happened that morning but declined to identify the chain. The limited public detail makes it difficult to compare this case directly with the Swedish and Belgian reports. Still, the recurrence of temperature changes across several countries makes the issue harder for retailers to treat as an isolated equipment fault.

Exposure extends beyond refrigeration

Refrigeration is one example of a wider set of remotely managed equipment in stores, including heating systems, cameras and alarms. Disrupting these systems can affect daily operations and food handling even when an incident begins in IT infrastructure. This is more significant than it looks: a connected control system can turn a technical intrusion into an immediate problem for staff, stock and customers. If you’re working in this space, the key question is whether operational equipment can be monitored and isolated quickly when unusual activity appears.

The source of the latest incidents has not been identified. Authorities also have not named those responsible for last month’s events in France, and no group has claimed responsibility. That uncertainty limits what can responsibly be said about coordination or intent. Here’s the thing: similar outcomes don’t by themselves prove a shared campaign, but repeated disruptions are a reason to examine how these systems are exposed and maintained.

What retailers should take from the reports

For grocery operators, the reports put the security and maintenance of connected operational equipment firmly on the day-to-day agenda. Patching matters, as Billow’s comments underline, but retailers also need a clear picture of which systems can change temperatures, who can reach them remotely and how quickly staff will learn that something is wrong. This isn’t only a question for security teams. Store operations and the people responsible for refrigeration have to be able to recognize an abnormal setting and respond while the incident is still unfolding.

And yet, the public accounts leave major gaps: investigations are continuing, some companies have offered little detail, and the cause of the latest incidents remains unknown. The next useful evidence will come from those investigations, including whether the cases share access paths or merely resemble one another in their effects. Until then, retailers face a straightforward operational lesson. Connected equipment can keep stores running efficiently, but it also needs the same attention to access, updates and incident response that companies give to their more familiar IT systems. A failure at the controls. A store problem by morning.