A second wave of refrigeration cyberattacks has disrupted supermarkets across several European countries, with attackers manipulating temperature controls and causing chilled or frozen stock to spoil. The incidents followed a similar operation that affected hundreds of French stores earlier in October.
The immediate warning concerns exposed refrigeration management interfaces. The longer-term problem is that some affected units are end-of-life products without available patches, meaning retailers cannot rely on software updates alone to restore secure remote management.
What happened in the second wave
Belgian supermarket chains Delhaize, Carrefour and Spar were affected, according to Belgian news agency Belga. The reported method involved remotely switching refrigeration units into defrost mode, allowing the equipment to warm.
The attack began around midnight on Sunday, according to Stephan Moelans, chief executive of Belgian refrigeration installer Sabcobel. Its technicians worked overnight and through the morning to disconnect affected units from the network. More than 50 Belgian stores were reportedly affected, while more than a dozen were identified in Ireland, Estonia, the Netherlands and Luxembourg.
Delhaize supermarkets were also affected in Luxembourg. Colruyt and Intermarche confirmed technical problems at some stores, but did not say those problems were caused by a cyberattack.
In Sweden, the Coop and Ica chains were affected. Freezer temperatures were reportedly raised to 50°C, while an Ica spokesperson said a small number of affected stores had connections outside the chain’s central network. BBC reporting also identified affected supermarkets in Finland.
Earlier in October, French stores lost refrigerated and frozen goods after attackers manipulated control systems manufactured by Danfoss, Copeland and Dixell. French cybersecurity agency Anssi said the attacks exploited remotely exploitable vulnerabilities in internet-exposed management interfaces. The Paris prosecutor’s office later put the number of victims at around 700.
No group had claimed responsibility for either wave, and it was not known whether the same perpetrators were responsible.
Why a patch cannot be the whole fix
The distinction between software support and physical security is central to these incidents. Sabcobel said the affected refrigeration units required physical modifications in addition to software updates.
A patch can address a software vulnerability when the manufacturer provides one. Disconnecting a unit can remove its immediate path to the internet. Neither action, however, necessarily establishes a safe long-term way to manage equipment that is no longer supported.
That leaves operators balancing immediate protection against operational needs. A freezer cannot simply be treated like an ordinary computer because failure produces visible physical consequences: rising temperatures and spoiled stock. Yet keeping a vulnerable controller connected to support remote access may preserve convenience at the cost of exposing refrigeration controls.
| Equipment condition | Immediate priority | Longer-term requirement |
|---|---|---|
| Internet-facing interface with a supported update | Remove unnecessary exposure and apply the available update | Maintain patching, access control and technical support |
| Internet-facing interface with no available patch | Disconnect or isolate the affected equipment | Plan physical modification or replacement |
| Physical modification required | Do not treat a software update as a complete repair | Arrange technician-led remediation |
| Equipment not identified or inventoried | Verify interfaces and remote-access paths | Include refrigeration systems in routine asset management |
The trade-off is therefore not simply “connected or disconnected.” Operators must determine whether the interface is exposed, whether a supported update exists, and whether the hardware itself needs to be changed. Isolation may reduce immediate risk, but it does not resolve the underlying support problem.
Who should act
Supermarket and grocery operators should begin with the refrigeration equipment that remains reachable through an internet-facing management interface. The affected systems reported in Belgium and Sweden shared the same general weakness as the systems compromised in France.
Security teams should identify remote-management interfaces, remove unnecessary exposure and document which devices can no longer receive vendor updates. Refrigeration contractors and technicians should also be part of that process because some repairs require physical work rather than configuration changes alone.
The wider lesson applies to other connected equipment with physical consequences. An exposed control panel can turn a maintenance convenience into an operational attack surface. Security controls that focus only on customer information may overlook systems whose compromise can cause food loss, service disruption or damage.
There is also a lifecycle problem. At the time of the reports, manufacturers had no legal obligation to fix products targeted by such attacks. The EU’s Cyber Resilience Act was expected to impose stricter requirements from December 2027, including support periods tied to a product’s expected lifetime. For equipment already operating without updates, that future requirement does not solve the immediate gap.
What to watch next
The key question is whether the exposed equipment remains online. Disconnecting affected units is an urgent containment measure, but operators must follow it with a permanent plan for unsupported systems.
Retailers, regulators and suppliers should also provide more detail about exposed interfaces, disconnected controllers, physical modifications and replacement schedules. That information would show whether the response is temporary containment or a sustainable correction of the underlying vulnerability.
Attribution remains uncertain. Belgium’s Centre for Cybersecurity said it was concerned about the rising number of incidents, partly because of the targeted use of AI, but it did not know whether AI had been used in these attacks. That concern should inform monitoring without being treated as proof of the attackers’ identity or methods.
The most important signal will be what happens to the older equipment after the spoiled food is removed. If vulnerable controllers are returned to service without patches or physical changes, the same route may remain available for another incident.
Key takeaways
- Internet-exposed refrigeration management interfaces create direct operational risk.
- Disconnection can contain an incident but does not repair unsupported equipment.
- Physical modification or replacement may be necessary when software updates are insufficient.
- Retailers need an inventory covering refrigeration systems, remote access and available vendor support.
Frequently asked questions
Did hackers cause the supermarket freezer failures?
The incidents were described as cyberattacks or suspected cyberattacks by retailers, contractors and equipment suppliers. In Belgium and Sweden, attackers reportedly manipulated refrigeration controls, causing units to warm and spoil stock.
Which European countries were affected?
The second wave included Belgium, Luxembourg and Sweden, with affected stores also reported in Ireland, Estonia, the Netherlands and Finland.
Were the French and later attacks carried out by the same group?
It was not known whether the same perpetrators were responsible. No group had claimed responsibility at the time of the reports.
Can a software update fully fix the affected refrigeration systems?
Not in every case. Sabcobel said the affected units required physical modifications in addition to software updates, while many of the end-of-life systems had no patch available.