“There has been a cyberattack and all our freezers reached 50C. Everything is destroyed.” That’s how Engla Ingwall, sales manager at an ICA supermarket in Stockholm, described Monday morning to Sky News. Her store wasn’t alone. Across Europe, grocery chains woke up to fridges and freezers that had been quietly cranked up to 50°C (122°F) overnight, turning chilled and frozen stock into garbage.
As UNILAD Tech reported, the wave hit stores in Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden. It comes just three weeks after hundreds of French supermarkets suffered the same kind of attack. And the most frustrating part, according to security researchers, is that the hole the attackers used was patched back in August.
The short version
- On November 2, hackers remotely raised fridge and freezer temperatures at dozens of supermarkets in at least seven European countries.
- Delhaize, Carrefour, Intermarché, Spar, ICA, SuperValu, Kesko, Selver and an IKEA store all reported problems.
- In mid October, a similar attack hit roughly 280 French stores, sparked fires and caused damage worth several million euros.
- Researchers say the refrigeration controllers sit on the public internet with built in support logins. A patch shipped in August, but thousands of units never got it.
- No group has claimed the attacks, and nobody has asked for a ransom.
Who was hit on Monday
The list of affected retailers reads like a directory of European grocery. Ahold Delhaize told CNBC that refrigeration systems failed in dozens of its Delhaize stores in Belgium and Luxembourg, forcing staff to throw food away. Carrefour said 15 Belgian stores were attacked. Intermarché said 15 of its 153 Belgian stores were affected. Colruyt Group reported five Spar stores. Even IKEA was caught up in it, with fridges and freezers failing at its store in Mons, Belgium, between Sunday and Monday.
In Ireland, SuperValu said refrigeration at 13 of its 223 stores was affected and that chilled and frozen products were pulled from sale. ICA, Sweden’s biggest grocer, confirmed incidents at “a limited number of stores” that ran on networks outside its central systems. Finland’s Kesko and Estonia’s Selver also reported disruptions.
| Retailer | Country | Stores affected (Nov 2) |
|---|---|---|
| Delhaize (Ahold Delhaize) | Belgium, Luxembourg | Dozens |
| Carrefour | Belgium | 15 |
| Intermarché | Belgium | 15 of 153 |
| SuperValu | Ireland | 13 of 223 |
| Spar (Colruyt Group) | Belgium | 5 |
| IKEA | Belgium (Mons) | 1 |
| ICA | Sweden | “A limited number” |
| Kesko, Selver | Finland, Estonia | Disruptions reported |
Most chains said things were back to normal by Monday evening. Intermarché said its security measures contained the attack quickly in most stores and that the losses were “nothing comparable to the attack in mid-October.” Luc De Laet, owner of Belgian butcher chain De Laet & Van Haver, put it more bluntly: “It’s very scary. They are hacking the system that is doing the registration of the temperature, and they can program it at a distance.”
What 122°F does to a freezer full of food
It’s worth pausing on the number, because 50°C isn’t a fridge that’s a little warm. It’s hotter than a summer day in Death Valley. Food safety rules treat anything between 40°F and 140°F as the danger zone, where bacteria multiply fastest, and the USDA says perishable food left in that range for more than two hours should be thrown out. A freezer that spends a night at 122°F loses everything in it.
France was the warning shot
Europe has seen this movie before, and very recently. On October 12, refrigeration systems at Intermarché, Coopérative U, Carrefour, Monoprix and other French chains heated up to 50°C overnight. According to NPR, somewhere between 150 and 200 Intermarché stores were targeted, along with nearly 100 Coopérative U outlets. Some units caught fire. Les Mousquetaires, which owns Intermarché, said it expected losses of “several million euros” across about 180 stores, and told CNBC that the attackers got in through a service provider that manages refrigeration in some stores.
Felix Aime of security firm Sekoia said at the time that the same campaign touched Spain, Portugal, Poland, Germany and Belgium. EU Agriculture Commissioner Christophe Hansen wrote on X that “the weaponization of food has become a reality.” Coopérative U chief executive Dominique Schelcher called it “extremely serious and unprecedented.”
How you hack a fridge
Big supermarket refrigeration isn’t a row of kitchen fridges. It’s a network of compressors, cases and sensors run by controllers that let a contractor watch temperatures remotely and get an alert when something fails. That remote access is the whole point. A failed freezer caught at 2 a.m. saves thousands of dollars in stock. It’s also the weakness.
Fredrik Blix, a strategic cybersecurity adviser at Visente AB, said in a LinkedIn post that the attack itself isn’t sophisticated. The controllers “sit directly on the public internet,” he wrote, with built in support logins whose passwords researchers showed could be obtained the same day. “The vendor patched it in August. Thousands of units never got the update, and the oldest models can’t be updated at all.” After the French attack, France’s national cybersecurity agency CERT-FR told operators to take the devices off the internet. Blix’s question for the installers: “What exactly did you do with those three weeks?”
Tom Hegel, a researcher at SentinelOne, explained to Sky News why grocery stores make such good targets. “Retail chains run enormous estates of refrigeration controllers, building management systems, door access panels and point-of-sale gear. Grocery margins are thin and stock perishes within hours, so any disruption hurts quickly and in public.”
[1] Controller exposed online …… reachable from anywhere
[2] Built in support login ……… credentials recoverable fast
[3] Setpoint changed remotely …… cooling target pushed to 50°C
[4] Alarms blunted or ignored …… damage happens overnight
[5] Staff find it at opening ……. stock destroyed, cases offline
Fix: patch firmware, pull devices off the public internet,
put remote access behind a VPN, change default logins
Readers have pointed out the same thing on Reddit. “They likely are not directly connected to the internet but have been compromised through an internal network, which is even more alarming,” one wrote. Another was more direct: “If this teaches companies, governments, and individuals to stop connecting everything to the internet, it’s ultimately a good thing they’re being hacked now.” We’ve seen the same pattern with other connected hardware, like the Flock camera that shipped with its encryption key sitting inside it.
Who’s behind it, and should Americans worry?
Nobody has claimed the November attacks, and nobody has demanded money. That silence is telling, Blix argued. It rules out ransomware crews, who want to get paid. What’s left is either someone doing it because they can, or someone who wants to create “unease in Ukraine-supporting countries without leaving fingerprints.”
The United States isn’t sitting this one out. CNBC reported that commissaries at six U.S. military bases suffered freezer malfunctions in late August, and four people familiar with the matter told Reuters that the Pentagon now treats those as a suspected hack and is coordinating with French authorities. NPR’s investigation also traced a destructive attack on an Israeli food plant in May, which wrecked its industrial freezers, to an Iranian military linked group called Cyber Isnaad Front. American supermarkets use the same kinds of controllers. Cyber officials in Asia have already been raising the alarm about attacks on everyday infrastructure, as when Japan declared a “state of emergency in cyberspace”.
Sources and further reading
- UNILAD Tech: Every country on high alert as cyberattacks force supermarkets to pull food from fridges
- CNBC: Supermarket fridges hit with cyberattacks across Europe
- CNBC: French supermarket fridges get hacked, heating to 122°F and sparking fires
- NPR: A new cold war, hackers target fridges across the globe
- Sky News: Hackers target refrigerators in Ireland and European countries
- NBC News: Supermarkets across Europe hit by new fridge cyberattacks
- USDA FSIS: The “Danger Zone” (40°F to 140°F)
About this article: GeekBlog covers U.S. technology news, AI, phones, smartwatches and gaming. Every story is written and checked under our Editorial Policy. Spotted a mistake or have a story tip? Contact our editors.
