Connected cooling systems forced offline
Dozens of supermarkets and other retailers across seven European countries have reported disruption to refrigerators and freezers in an apparent cyberattack, forcing stores to remove chilled goods and disconnect affected equipment from networks. Incidents were reported in Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia and Finland, with some refrigeration temperatures said to have risen as high as 50C.
Around 40 Delhaize supermarkets in Belgium and Luxembourg were affected. Sabcobel, which operates Delhaize refrigeration systems, said evaporators had been switched into defrost mode and technicians worked overnight to isolate installations. The company described the incident as a cyberattack and said protecting some systems required physical modifications rather than only a software update.
Other Belgian retailers reported narrower disruption. Carrefour said 15 stores were affected but remained open, while Colruyt Group said five shops using its Spar franchise had refrigeration systems attacked. An Ikea store in Mons removed some food after its cooling equipment was affected. One Delhaize branch in Hoeilaart estimated that it lost €100,000 in produce, before accounting for the cost of closing.
In Sweden, several ICA and Coop locations were hit. ICA said the incident involved a small number of stores outside its central network, while Coop said seven of its roughly 800 stores were affected and the situation had been contained. A shop in Sjöbo reported that temperatures had been set to 50C overnight. Sweden's national cybersecurity agency said it was monitoring incidents, as was its Belgian counterpart.
The disruption also reached 13 SuperValu supermarkets in Ireland, where the operator said a cyber incident was limited to a particular refrigerator model. Reports from the Netherlands, Estonia and Finland described similar problems at smaller groups of businesses. The United Kingdom's National Cyber Security Centre said it was working with international partners and industry to understand the incident; no British cases had been reported.
The identity and motive of the attacker remain unknown. The reported method resembles an October incident that affected hundreds of French supermarkets and caused large quantities of food to be discarded. That similarity does not by itself establish that the same actor was responsible. Authorities in the United States are also examining refrigeration failures at military bases, but no confirmed connection has been announced.
The episode demonstrates the operational risk attached to internet-connected building equipment. Remote access can simplify maintenance across a large store estate, but exposed or insufficiently protected controllers can turn a network intrusion into immediate physical losses. Retailers now face the combined task of restoring safe temperatures, verifying food quality and modifying devices that cannot be secured through a routine software change. Until investigators identify the entry point and responsible party, claims about attribution would be premature.
