Multiple supermarket chains across Europe have suffered disruptions to their refrigeration infrastructure following a coordinated cyberattack. Attackers gained remote access to cooling and freezer systems, altering temperature controls and in some instances triggering defrost cycles that caused widespread product spoilage. Store managers were forced to respond in the early morning hours to prevent further losses.
The scope of the incident spans more than 115 locations across Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia. While the exact nature of the attack vector remains unclear, authorities have not yet determined whether all affected stores were targeted as part of a single coordinated campaign or struck individually.
Affected retailers and store counts
- ICA (Sweden) — at least 4 locations
- Coop (Sweden) — 7 locations
- Ahold Delhaize (Belgium and Luxembourg) — approximately 40 locations
- Carrefour (Belgium) — 15 locations
- Spar Colruyt (Belgium) — 5 locations
- Intermarché (Belgium) — approximately 15 locations
- SuperValu (Ireland) — 13 stores
- Selver (Estonia) — 1 store
- Netherlands — at least 17 butcher shops and neighborhood stores
- Additional retailers in Belgium including an Ikea superstore, grocery outlets, and specialty shops
Response from affected chains
ICA's press officer stated: "We can confirm that we have been informed of an incident overnight affecting a small number of ICA stores operating outside ICA's central network. The incident impacted the stores' refrigeration and freezer systems. ICA is currently supporting the affected stores in managing the situation."
The Colruyt Group indicated that "there is an impact on the refrigeration systems at around five Spar stores. These stores are operated by independent entrepreneurs who have their own refrigeration systems. We are currently doing everything we can to resolve the issue."
Ahold Delhaize reported that "We have identified an IT incident affecting the refrigeration systems in several dozen stores," and noted that the company "immediately took the necessary measures to keep our stores operational."
Coop confirmed that "a small number of stores were affected overnight into Monday - specifically 7 out of more than 800 stores. The situation is currently contained and under control. The issues have ranged from completely shut-down refrigerators and freezers to partially functioning units, and in one case, the system beginning to generate heat."
Carrefour stated: "The impact at Carrefour is very limited: currently 15 of our 700 stores are affected, both in Flanders and Wallonia. Not a single hypermarket is among them. All stores remain open because it only concerns a few refrigeration units, mainly freezers. Quick action was taken so that all stores can stay open."
Technical details and vendor involvement
An ICA store manager reported to TV4 that overnight temperature settings had been remotely adjusted to +50°C (122°F) and could not be changed locally, necessitating the disposal of frozen inventory. RTL media reported that Ahold Delhaize alerted store managers via SMS around 4 a.m., with some locations deploying refrigerated trucks to salvage stock.
Sabcobel, identified as the refrigeration system vendor across several impacted locations, attributed the incident to exploitation of a vulnerability previously used in attacks on French retailers last month. Sabcobel's director, Stephan Moelans, explained that technicians began disconnecting affected systems starting at 1 a.m. and traced the disruption to remotely activated defrost functions.
Moelans noted that while software updates provide some protection, the vulnerability requires physical modifications to refrigeration units. He stated: "The simplest solution is to manage the refrigerators via a secure internet connection. Most of our clients have adopted this solution since the attack in France."
Last month's attacks in France targeted hundreds of retail locations using Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB refrigeration controllers. Attackers remotely configured these devices into defrost mode, causing similar disruptions.