Suspected hackers disrupt supermarket freezers across Sweden, Belgium, Luxembourg

Supermarkets in Sweden, Belgium and Luxembourg reported refrigeration and freezer system incidents overnight and on Monday.

Coop said six stores in Sweden were affected, according to Aftonbladet on Monday. Six of the affected Coop stores were in central Sweden, and seven were out of 800 stores nationwide. Freezer temperatures rose at multiple ICA and Coop supermarkets in Sweden. ICA Kvantum in Sjoebo said its freezer temperature reached 50C (122F), and the store suspects a hack. <cite-list>The Guardian, Insurance Journal, BBC News, AOL.com, Ynetglobal</cite-list>

ICA said it knew of a limited number of stores affected overnight by an incident that hit refrigeration and freezer systems, though it did not confirm a cyber attack. “We are aware that a limited number of stores were affected by an incident overnight,” an ICA Sverige spokesperson said. Two more ICA stores in Sweden reported refrigeration issues. <cite-list>The Guardian, AOL.com, Insurance Journal, BBC News, AOL.com</cite-list>

ICA represents roughly one-third of grocery sales in Sweden, while Coop represents roughly 17%. Rickard Nilsson, who manages an Ica shop in Sjoebo, told Aftonbladet that warm air was getting into the freezers and that all stock was ruined. “Hot air is blowing into the freezers,” he said. Camilla Nilsson manages Ica St Olof in Osterlen and said hackers accessed refrigeration management systems and changed settings. <cite-list>Insurance Journal, AOL.com</cite-list>

Stephan Moelans, chief executive of Sabcobel, said intruders remotely switched evaporators to defrost mode, causing refrigerators to heat up. After attackers remotely changed settings, temperatures climbed from minus 27C to above 50C in thousands of freezers, fridges and chiller cabinets. At least 70 stores across Belgium, Sweden, Ireland, Luxembourg and Estonia were affected, and the attacks caused at least EUR 100,000 in lost food. <cite-list>The Guardian, AOL.com</cite-list>

Fresh produce was lost at 13 SuperValu stores in Ireland. Estonian media said intruders remotely accessed a cooling-system computer and raised temperatures to 50C at a major supermarket chain. <cite-list>BBC News, AOL.com</cite-list>

Dozens of supermarkets in Belgium and Luxembourg saw fridge and freezer problems in an IT incident reported by Ahold Delhaize. Delhaize, which Ahold Delhaize owns, reported refrigeration problems at about 40 Belgian stores on Sunday night. Sarah De Meester, a spokesperson, said temperatures were rising in cooling systems and that the incident was under investigation. Ahold Delhaize later confirmed the incident was a cyber attack. <cite-list>The Guardian, Insurance Journal, BBC News, AOL.com, Ynetglobal</cite-list>

Carrefour Belgium and Spar outlets reported similar problems with refrigeration. Le Soir said dozens of stores were affected, including Proxy Delhaize minimarkets and several Shop & Go sites at Q8 stations. <cite-list>Insurance Journal, BBC News, AOL.com, The Guardian</cite-list>

The Delhaize store in Hoeilaart, Flemish Braband, lost EUR 100,000 of produce, not counting further losses from closing the shop. Carrefour said 15 Belgian stores were affected and that immediate measures kept every shop open. Cyber-security bodies in Belgium and Sweden said they are tracking the event. Sweden’s National Cybersecurity Center said it is participating in the investigation. <cite-list>BBC News, Ynetglobal</cite-list>

A similar attack occurred in France in October. French police said hackers took control of cooling units at as many as 700 supermarkets in October, causing heavy losses of refrigerated and frozen goods. The French attack took place overnight Oct. 11-12 after intruders gained remote access to temperature-control software for refrigerators, freezers and cold-storage rooms. <cite-list>The Guardian, Help Net Security, Insurance Journal, Ynetglobal</cite-list>

Affected French chains included Intermarche, Cooperative U, Carrefour, Leclerc and Monoprix. Early French reports counted more than 400 affected supermarket locations, with at least 300 Intermarche and Netto stores among them. Those reports also cited nearly 100 Cooperative U outlets, roughly 80 Carrefour supermarkets, about 30 Monoprix stores and several E.Leclerc sites. Les Mousquetaires confirmed that about 150 of its stores were directly affected. <cite-list>The Guardian, Ynetglobal</cite-list>

Losses from discarded fresh meat, dairy and frozen products ranged from tens of thousands of euros to more than EUR 130,000. Combined losses at two stores in Alsace reached EUR 270,000. Estimated losses from the French attack reached the tens of millions of euros, and retailers discarded tons of spoiled food. Fires broke out in several cases during the French attack. <cite-list>The Guardian, Ynetglobal</cite-list>

The Paris prosecutor’s office opened a formal investigation into the French attack, though French authorities have not publicly named those responsible. Prime Minister Sebastien Lecornu instructed ANSSI to investigate, and ANSSI later confirmed that retailers using controllers from two other suppliers were also attacked. <cite-list>The Guardian, Ynetglobal</cite-list>

European officials raised concerns about possible Russian hybrid operations, but authorities have found no public evidence connecting Russia to the supermarket attacks. <cite-list>Ynetglobal</cite-list>

During the French attack, intruders mostly compromised Danfoss controllers, disabled alarms and then adjusted thermostats or lengthened defrost cycles. Danfoss said it discovered security flaws last year and had long urged customers to install updates. On Sept. 18, Danfoss reported a flaw that allowed access to internal system variables and the upload and execution of unauthorized code. <cite-list>The Guardian, Ynetglobal</cite-list>

There is no public confirmation that the flaw was exploited in the French attack. Danfoss said affected units were running outdated firmware and that it has long told customers to update supported systems and replace older equipment. Danfoss noted that hackers breached or attempted to breach supermarket refrigeration systems in Russia and Israel in 2022 with outdated versions of its controllers. <cite-list>Ynetglobal</cite-list>

Most supermarket cold aisles connect to the internet so technicians can do remote maintenance and receive failure alerts. In August 2026, Claroty’s Team82 researchers disclosed multiple flaws through web management interfaces in Danfoss AK-SM 800A refrigeration controllers and Copeland XWEB Pro supervisory controllers. Both vendors released fixed firmware. <cite-list>The Guardian, Help Net Security</cite-list>

Refrigeration units at US military commissaries were similarly affected in late August 2026. Several US military bases reported refrigeration failures starting Aug. 26. All commissary freezers at Fort Huachuca in Arizona switched to defrost mode overnight, spoiling food. Some commissaries temporarily offered only shelf-stable products, while others limited sales. <cite-list>Help Net Security, Ynetglobal</cite-list>

Army and Air Force investigative units opened an inquiry, including the cybercrime unit of the Army Criminal Investigation Division. The Pentagon said last week it was examining food-storage freezer failures at multiple US military facilities. Last week, Reuters reported that the Pentagon suspected a cyber attack lay behind the military refrigeration failures. <cite-list>Insurance Journal, Ynetglobal</cite-list>

American cyber investigators worked with French law enforcement on the matter. Last month, Ahold Delhaize reported a cybersecurity incident to Dutch police. Last month, a cyber attack caused days of service outages and empty shelves at Ahold Delhaize stores in the Netherlands. It has not identified the cause of that incident.

Authorities established no link between the French supermarket cyber attack and the Ahold Delhaize security issue. <cite-list>The Guardian, Help Net Security, Insurance Journal, Ynetglobal</cite-list>

On Oct. 12, Ahold Delhaize said it was addressing a network security issue by taking some systems offline while stores remained open. Albert Heijn distribution centers stopped work, and its websites and apps stayed offline. Shoppers could not place orders online, and in-store customers saw outdated prices on electronic shelf signs. Stop & Shop workers could not access schedules and paystubs. <cite-list>Help Net Security</cite-list>