By 
Suspected cyberattacks targeting supermarket refrigeration systems have affected retailers in nine European countries, disrupting cold storage and forcing some stores to discard chilled and frozen food. The European Commission has convened cybersecurity agencies and national authorities to coordinate a response, while investigations into the incidents continue.
The incidents were reported on 2 November in Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden. The attacks appear to have interfered with connected refrigeration controls, causing temperatures in some fridges and freezers to rise sharply.
The European Commission says the incidents affect more than one member state and require information-sharing and a coordinated response. Officials have not attributed the attacks to a government, criminal group or other actor.
Which European countries and supermarket chains were affected?
Reports from retailers and national authorities point to disruption across nine countries. Affected businesses include Carrefour, Delhaize, Colruyt, ICA, Coop, SuperValu and Intermarché, as well as an IKEA store in Belgium.
In Belgium, Carrefour said around 15 of its more than 700 stores were affected. Colruyt reported problems at five Spar stores, while other retailers also reported refrigeration incidents. Delhaize stores in Belgium and Luxembourg experienced problems, and IKEA said refrigeration equipment at its Mons store was affected.
In Sweden, Coop confirmed incidents at a limited number of stores and said the affected equipment had been restored. ICA also reported problems at a limited number of locations. In Ireland, Musgrave said 13 SuperValu stores were affected. In Portugal, the Mosqueteiros group reported incidents at seven Intermarché stores, apparently involving an external provider responsible for refrigeration management.
Retailers in Finland, Estonia, the Netherlands and Italy also reported incidents or abnormal refrigeration behaviour. The precise number of affected stores differs between reports, and there is not yet a single verified Europe-wide total.
How can a cyberattack make supermarket freezers warm up?
Many modern supermarket refrigeration systems use connected controllers that let store operators and specialist contractors monitor temperatures, schedule defrost cycles and manage equipment remotely. That connectivity helps retailers maintain large stores efficiently, but it also creates an attack surface if remote access is exposed or poorly secured.
In the incidents reported this week, refrigeration units were apparently switched into defrost mode or otherwise manipulated so that temperatures rose. In some cases, reports described freezer temperatures reaching around 50°C. Food that has not been kept within safe temperature limits may need to be removed and discarded.
The incidents illustrate the risks associated with operational technology: digital systems that control physical equipment. A compromise does not have to disable a supermarket’s tills or corporate network to cause serious disruption. Interference with building-management or refrigeration controls can affect store operations and perishable stock directly.
European Commission coordinates a cross-border response
On 3 November, the European Commission confirmed that it had convened two coordination meetings. The first involved the EU interinstitutional task force, including the European Union Agency for Cybersecurity (ENISA), Europol and relevant Commission services. A second meeting was held with EU member states and national authorities through the EU-CyCLONe network.
The Commission said the meetings were intended to exchange information about the incidents and coordinate a collective response. It also cautioned against speculation about who was responsible, stressing that national authorities are conducting the investigations.
In its 3 November press briefing on the supermarket refrigeration incidents, the Commission said the events show how cyberattacks can disrupt essential services and affect citizens’ daily lives. Officials also pointed to EU frameworks including the Cyber Resilience Act, the Cyber Solidarity Act and the NIS2 Directive.
Why the latest incidents raise concern after France’s October attack
The incidents follow a similar attack reported in France on 12 October, when refrigeration systems at supermarkets and other food retailers were disrupted and stores had to dispose of spoiled stock. The recurrence of similar incidents across several countries has prompted questions about shared technology, remote access arrangements and the security of third-party service providers.
Some reporting has identified refrigeration equipment or services associated with Danish manufacturer Danfoss at affected locations. That does not establish that one supplier was responsible for the incidents or that every affected retailer was compromised in the same way. Investigators have not publicly confirmed a common technical cause across all countries.
Who is behind the supermarket cyberattacks?
No group has publicly claimed responsibility, and authorities have not identified a perpetrator. It is too early to describe the incidents as a state-sponsored operation, a coordinated sabotage campaign or a conventional ransomware attack. Those possibilities require evidence that has not been made public.
Investigators will need to establish how attackers accessed the systems, whether the incidents share infrastructure or methods, and whether weaknesses in remote-management services or connected controllers were exploited. Until then, attribution should remain open.
What the incidents mean for supermarket cybersecurity
The events are a reminder that cybersecurity is not limited to protecting customer data, websites and payment systems. Retailers also depend on connected equipment that keeps food at safe temperatures and stores operating normally.
Supermarkets and their technology suppliers may need to review internet exposure, remote-access permissions, software updates, network segmentation and monitoring for refrigeration controllers. They also need clear manual procedures for checking temperatures and protecting stock if remote systems become unavailable.
For consumers, retailers and food-safety authorities, the immediate priority is to ensure affected equipment is operating safely and that any food exposed to unsafe temperatures is handled appropriately. The wider question is whether Europe’s retailers can make essential connected systems more resilient before similar incidents spread further.
