Supermarkets across Europe are counting the cost of a cyberattack on their refrigeration systems. The disruption began in Scandinavia and the Benelux countries and has now reached Germany, Romania and the United Kingdom. The European Commission says these are not isolated incidents and that Europe must be collectively resilient. The EU has declined to blame anyone.
What happened
The first reports came early on Monday. Problems were reported in at least nine EU countries: Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden. On Tuesday, officials and company representatives said four supermarkets in Germany and six in Romania were affected. The UK, which is outside the EU, was also hit.
The most vivid pictures came from southern Sweden. One ICA store said its refrigerators and freezers had been hacked overnight and set to 50°C. At the ICA Kvantum branch in Sjöbo, staff carried spoiled goods out to a large container. That temperature is roughly 122°F, far above anything a freezer is built to withstand.
In Belgium and Luxembourg, Ahold Delhaize and Colruyt said an overnight IT incident had hit fridges and freezers in dozens of stores. A Carrefour Belgium spokesman called it a cyberattack and said there was no other explanation. Ikea Belgium said the same thing had happened at its Mons store.
Not the first wave
The incidents follow a similar episode last month in France. Police there said hackers took control of cooling units at hundreds of supermarkets, raising temperatures as high as 122°F and causing fires and food losses. The European Commission said the latest attacks show how digital threats can reach into everyday life.
That history explains why officials are reluctant to treat Monday’s events as a one-off. One analyst told AFP that the spread beyond France to other countries had been expected.
Who is responsible?
No group has been identified in any of the reports reviewed for this article. Opinions on the attackers differ.
The Commission spokesperson refused to point the finger at any potential culprit. Dan Cimpean, director of Romania’s National Cyber Security Directorate, told AFP that no other infrastructure was compromised and that the attack seemed “semi-amateurish.” He said he did not suspect a state actor under any circumstances.
His view is one official’s early assessment, not a finding shared by other governments. The investigations are in their early stages, and attribution in cyber incidents often takes weeks or months.
Why refrigeration is exposed
The explanation lies in how modern supermarkets work. Retailers allow their freezers to connect to the internet so that maintenance and monitoring can be done remotely. That convenience creates a way in for attackers if the connection is poorly secured.
A detail from Sweden hints at one weak point. Coop said the refrigerators and freezers affected at seven of its stores had been connected to “old 4G networks,” and that the stores had since resumed normal operations. It is not yet confirmed that the same route was used in other countries, so this should be treated as a clue rather than a conclusion.
What it means for shoppers and retailers
For customers, the immediate effect has been local: empty freezer cabinets, discarded stock and some stores operating below normal capacity. The larger risk is to retailers. A frozen-food or dairy chain that loses temperature control for a few hours can lose an entire stock cycle, and food safety rules mean contaminated goods cannot simply be salvaged.
The attacks also test a long-standing assumption in retail. Refrigeration, heating and lighting controllers have historically been treated as facilities equipment, not as targets for cybercriminals. The pattern now visible across more than a dozen countries suggests that assumption needs revisiting. Security teams will want an inventory of every internet-connected control unit, a check on whether older mobile links can be retired, and a plan for manual temperature monitoring if remote systems are compromised.
Governments are also under pressure. The Commission’s insistence on collective resilience signals that EU capitals are likely to share information more closely over the coming days. Whether that leads to coordinated advice for retailers, or to new rules on connected equipment, is not yet clear.
What happens next
Investigators in the affected countries will try to establish how the attackers gained access, whether one group or several are involved, and whether the incidents in France last month and those this week share a common method. Retailers, meanwhile, are checking stock and restoring systems.
For now, the facts are limited but serious: stores in at least 11 countries have lost refrigeration control, food has been destroyed, and the European Union is telling its members to prepare for more.
