Second wave of suspected cyberattacks hits supermarket freezers across Europe

Supermarket and grocery store refrigerators across Europe appear to have been hacked in the early hours of Monday morning — the second such wave of hacks in recent weeks where attackers have manipulated temperature controls and caused stock to spoil.

Retailers said a “limited number” of smaller stores in Sweden were impacted, while more than 50 have been identified in Belgium and over a dozen others in Ireland, Estonia, the Netherlands and Luxembourg.

The incident has been described as a cyberattack by retail companies and equipment suppliers, although no law enforcement or government agency has yet identified the perpetrators.

Katrien Eggers, spokesperson for the Centre for Cybersecurity Belgium (CCB), told Recorded Future News that her agency was aware of the incident but unable to provide further information.

“It is not known who is behind this attack, and it may never be possible to identify them,” she said.

It comes three weeks after a similar cyberattack hit hundreds of supermarkets in France, when hackers compromised internet-exposed remote controllers for refrigeration systems at numerous supermarkets.

The Paris prosecutor’s office told Recorded Future News there were around 700 victims in October’s attack. At the time, France’s cybersecurity agency ANSSI said it was aware of attacks on a range of refrigeration system remote controllers made by different brands.

No group has claimed responsibility for Monday’s hack, nor the previous one in October, and it is not known whether they were carried out by the same perpetrators.

Retailers have described an incident that echoes the previous French scenario, saying their freezers had been remotely set to 50°C.

“We can’t adjust the temperatures, we can’t change them. Heat is blowing into the freezers. Everything is ruined,” Rickard Nilsson, a supermarket manager in southern Sweden, told broadcaster TV4.

Stephan Moelans, the chief executive of installation company Sabcobel, told the Belga news agency that his business began mobilising its technicians at 1 a.m. to address the attacks.

He said Sabcobel knew of around 20 affected refrigeration units out of the hundreds it manages across Belgium, adding that the affected units needed physical modifications and not just a software update to address the vulnerabilities.

The CCB’s Eggers said her agency was “concerned about the rising number of incidents, partly due to the targeted use of AI,” which she described as “a development that has unfolded over the last six months, and the situation is changing very rapidly.”

She said the CCB did not yet know whether AI was used as part of the attacks. “We have recently seen a huge rise in the number of vulnerabilities where AI has been used to identify and exploit them,” she added.

In Estonia, a contractor said the attackers accessed an older Danfoss system, and Dutch broadcaster NOS reported that Copeland equipment was also targeted in Belgium. After the French attack, both companies said the affected devices were mainly discontinued products that no longer received security updates.

Although the EU’s Cyber Resilience Act will impose stricter requirements on such products from December 2027 — when manufacturers will have to provide a support period reflecting a product’s expected lifetime — there are currently no legal obligations on manufacturers to fix products targeted by such attacks.

In an October newsletter last year, Danfoss said it was enforcing a “hard End of Service” policy for those and other legacy products, citing “recent European cybersecurity legislation.” Continuing support, it said, “would place Danfoss under new legal obligations to maintain security updates.”

The newsletter referenced earlier attacks involving its controllers, including a campaign at the start of the Russian invasion of Ukraine in which attackers targeted Russian supermarkets using the controller. Another 40 stores were hacked in Israel, all of which Danfoss said lacked adequate firewall or VPN protection.