Hackers push supermarket fridges to 50°C in at least six European countries, three weeks after France's 700-store attack

Attackers took remote control of refrigeration systems at dozens of supermarkets across at least six European countries overnight into Monday, November 2, heating some fridges and freezers to 50°C and forcing stores to throw away chilled and frozen food. Stores in Sweden, Belgium, Luxembourg, Ireland, Estonia and the Netherlands were affected. Nobody has claimed responsibility.

It is the second wave in three weeks. On October 11, refrigeration controllers at up to 700 French supermarkets were hacked in a single night, in what has been described as the first cyberattack to hit a country's food supply in a physical way.

Store by store: who was hit on Monday

The companies have given their own counts, and there is no official total. Together they come to several dozen shops.

Country	Chain or company	What it said
Belgium, Luxembourg	Delhaize	Refrigeration hit in "several dozen" stores, most in Belgium
Belgium	Carrefour Belgium	15 of more than 700 stores; "extremely limited" impact
Belgium	Colruyt Group (Spar franchise)	Fridge systems attacked at 5 shops
Belgium	IKEA Mons	Fridges and freezers hit; store stayed open
Ireland	Musgrave (SuperValu)	13 stores; chilled and frozen food pulled
Sweden	Coop	6 stores in central Sweden
Sweden	ICA	"A limited number" of stores using an outside supplier
Estonia	Selver	1 store; temperature raised to 50°C
Netherlands	Ahold Delhaize	"A number of" stores; no figure given

An ICA Kvantum store in Sjöbo, in southern Sweden, told customers on social media that its fridges and freezers had been hacked and set to 50°C, and that staff were throwing the stock away. ICA said its own central systems were not touched: the affected shops used an outside refrigeration supplier connected to the internet outside the group's network.

Defrost mode and 50°C settings

The method looks the same in each country. In Belgium, the chief executive of Sabcobel, the firm that runs Delhaize's refrigeration, said the cabinets' evaporators had been switched to defrost mode. In Estonia, the refrigeration contractor said the attackers got into a computer that controls the cooling units and raised the temperature. It said the intrusion was stopped within minutes and caused no major damage.

Delhaize called it an "IT incident" and said the range of fresh and frozen products in affected stores would be "somewhat limited" for a time. Musgrave said its monitoring systems raised the alarm, it acted at once, and by Monday evening the problem was fully resolved and restocking was under way.

The French attack on October 11

The October attack was far larger. Hundreds of Intermarché and Netto stores were hit, along with about 80 Coopérative U shops, about 80 Carrefour stores, around 30 Monoprix branches and several E.Leclerc supermarkets. French police said the hackers seized control of cooling units and raised temperatures as high as 50°C, causing fires and food losses. One store in Normandy reported cabinets reaching 80°C. Alarms did not go off, and many shops were unstaffed overnight.

The weak point in France was refrigeration controllers made by the Danish company Danfoss, mainly the AK-SM800 and the older AK-SC355, both past the end of their supported life. A flaw in their web login was disclosed in March 2025 and patched in August 2025, but thousands of the devices were still reachable from the internet. Prime Minister Sébastien Lecornu ordered France's cyber agency, ANSSI, to investigate and to work with other European governments. Losses were estimated at tens of millions of euros.

Investigators have not said whether Monday's attacks used the same equipment.

No suspect, and no claim

Sweden's national cybersecurity centre said it was dealing with several incidents at grocery stores and could not say who was behind them. Its head, John Billow, said that in recent weeks the centre had found "quite a lot" of exposed industrial control devices in Sweden and had urged owners to update or patch them.

The European Commission said the incident shows how digital threats increasingly reach people's everyday lives. Security researchers have noted that the attack needs little skill when devices still use default logins, so the culprits could be anyone from a state-backed group to amateurs.

What shoppers should know

• Affected chains say spoiled food was removed before it could be sold. Fresh and frozen shelves in those shops may be thin for a few days.
• If you bought chilled or frozen food on Monday from an affected store and it seemed warm or soft, the store's normal refund rules apply. Keep the receipt.
• The attacks hit store equipment, not payment systems. No chain has reported customer data being taken.

The same kind of controllers are used in supermarkets, cold stores and pharmacies worldwide, including in South Asia and the Gulf, so security agencies are likely to repeat their advice: take the units off the open internet and change default passwords. Investigations in Sweden, Ireland and the Netherlands are continuing.