Supermarkets across Europe are scrambling to secure their refrigeration networks after a suspected cyberattack forced freezer units into defrost mode, spoiling massive stockpiles of food.
The breach hit shops in seven countries, with Belgian and Luxembourg outlets of food retailer Delhaize bearing the brunt. Around 40 of its stores were affected, according to Stephan Moelans, 47, CEO of Sabcobel, the firm that operates the systems Delhaize uses. Moelans confirmed to media outlets that his company was deliberately targeted.
The attack spread well beyond the Low Countries. Stores in Finland, Estonia, Ireland, the Netherlands, and Sweden also reported compromised units during the outage. In each case, evaporators remotely switched to defrost mode, allowing temperatures inside display freezers to climb dramatically. Some units reportedly warmed to 50°C, roughly 122°F, rendering frozen goods unsalvageable.
One Delhaize branch in Flanders, northern Belgium, told Het Laatste Nieuws that it alone lost approximately €100,000 in products, equivalent to nearly $112,000. The branch manager noted that figure covered only the destroyed merchandise, excluding revenue lost from temporary closures while technicians worked to restore systems.
Moelans said his engineers had been “working all night and morning to disconnect the affected units from the network.”
“The simplest solution is to manage the fridges over a secure internet connection,” he added. “Most of our customers switched to that after the attack in France.”
That reference pointed to a strikingly similar incident months earlier. In October, hundreds of French supermarkets suffered an identical attack mode, with freezers remotely switched to defrost. Media reports at the time estimated millions of dollars in food losses after products either thawed or sat at unsafe temperatures, forcing disposal. The October breach had served as an early warning that supermarket refrigeration networks, increasingly managed through internet-connected systems for remote maintenance convenience, carried exploitable vulnerabilities that hackers could weaponize.
Moelans emphasized that software patches alone would not suffice against this threat vector. He explained that protecting customers’ fridges against the vulnerability requires physical alterations to the units, not merely digital updates.
Multiple major retailers beyond Delhaize acknowledged impacts. French-owned Carrefour reported 15 Belgian stores affected, though it stated measures were taken to keep locations operational. Colruyt Group, which franchises Spar stores in Belgium, confirmed five of its outlets were hit. IKEA disclosed that refrigeration systems at its Mons, Belgium location were compromised, with a spokesperson adding that the company “cannot rule out that additional locations may be affected.”
Swedish grocery chain ICA issued a statement acknowledging that a “small number of ICA stores operating outside ICA’s central network” were impacted and that it “is currently supporting the affected stores in managing the situation.”
The interconnected nature of modern commercial refrigeration created this attack surface. Most European supermarket freezers now link to the internet to enable remote diagnostics and basic maintenance, a convenience that has simultaneously opened doors for malicious actors to manipulate temperature controls at scale. No group or individual has claimed responsibility, and authorities have not publicly identified suspects.