Supermarkets across several European countries have reported serious disruptions to their refrigeration systems, with suspected cyberattacks causing abnormal temperature increases in food-storage equipment and prompting investigations into the security of connected infrastructure.
Retailers in Belgium, Luxembourg, Sweden and Estonia confirmed problems on Monday, November 2, following overnight incidents affecting refrigerators and freezers.
The disruption follows a series of attacks against supermarket refrigeration equipment in France during October, where remotely manipulated cooling systems caused substantial food losses and, in some reported cases, fires.
Reuters reported that several retailers were investigating suspected cyber interference, while Sweden's national cybersecurity authorities confirmed they were examining incidents affecting grocery stores.
The developments have raised concerns about the vulnerability of internet-connected equipment used in essential commercial operations.
However, investigators have not established that all the incidents were caused by the same attackers or that a coordinated international operation was responsible.
Dozens of Belgian supermarkets affected
Belgium was among the countries reporting significant disruptions.
Ahold Delhaize, the Dutch retail group that operates Delhaize supermarkets, confirmed an information technology incident affecting refrigeration equipment at stores in Belgium and Luxembourg.
Approximately 40 Delhaize locations in Belgium were affected, according to reporting from Belgian news agency Belga cited by Bloomberg and other outlets.
The company said temperatures had risen in refrigeration systems and that technical teams were investigating the cause.
Retailers moved to isolate affected equipment from internet connections and restore normal cooling operations.
Carrefour Belgium also confirmed problems at 15 outlets, while Colruyt Group reported that five SPAR stores were affected.
A Belgian refrigeration specialist told Belga that equipment had been switched into defrost mode, a function normally used to remove accumulated ice from cooling systems.
If activated improperly or left operating for an extended period, defrost functions can cause temperatures to rise and compromise the storage conditions required for perishable food.
The precise technical method used in the latest incidents has not been publicly established.
Swedish stores report unusual temperature settings
Similar incidents were reported in Sweden.
Major grocery retailers ICA and Coop acknowledged problems affecting refrigeration equipment at a limited number of their stores.
At an ICA Baronen supermarket in Stockholm, employees discovered that freezer equipment had stopped operating normally.
A notice at the store attributed the disruption to a cyberattack.
The store's sales manager told Reuters that the incident occurred at approximately 2 a.m. local time and was discovered around 5:30 a.m.
Another ICA store reported on social media that its refrigeration equipment had been interfered with and its temperature settings changed to 50 degrees Celsius.
That figure refers to a reported manipulated setting; it does not establish that all the affected food or freezer compartments physically reached that temperature.
Coop also confirmed several affected stores.
Swedish cybersecurity authorities said they were investigating incidents involving refrigeration systems across the country.
John Billow, head of Sweden's national cybersecurity centre, warned that significant numbers of operational technology devices remained exposed to security vulnerabilities.
Such equipment requires appropriate software updates, security patches and network protection.
Estonia reports another refrigeration incident
Estonia also reported a similar disruption.
Technology supplier Kitman Coldtech told Estonian public broadcaster ERR that refrigeration equipment at a supermarket chain had experienced abnormal temperature settings.
The company's chief executive, Jann Mutso, said the incident had occurred that morning.
The supplier did not publicly identify the affected supermarket chain in the initial reporting.
Reuters reported that temperature settings had been altered to 50 degrees Celsius.
The Estonian incident adds to concerns that the problem may extend beyond a single retailer or national market.
Nevertheless, the similarity of the reported disruptions is not sufficient to prove that every incident involved the same vulnerability, equipment supplier or attacker.
French attacks provide troubling background
The latest incidents follow a larger series of refrigeration cyberattacks in France during October.
French authorities reported that hackers had remotely manipulated cooling systems at hundreds of supermarkets.
The attacks reportedly affected equipment at major grocery chains, including Carrefour, Intermarché and Leclerc.
Some refrigeration systems were set to unusually high temperatures, resulting in spoiled food and significant commercial losses.
Fires were also reported in connection with some earlier incidents.
French cybersecurity authorities investigated vulnerabilities involving internet-connected refrigeration controllers.
The investigation identified affected equipment from multiple manufacturers, including systems associated with Copeland and Dixell.
Equipment manufacturer Danfoss has also faced questions about vulnerabilities affecting connected cooling infrastructure.
However, Danfoss said no connection had been established between its products and the latest November incidents.
The earlier French attacks provide important context, but investigators have not publicly demonstrated that the same individuals were responsible for the new disruptions.
Why refrigeration systems are vulnerable
Modern supermarkets increasingly rely on digitally connected systems to manage refrigeration, lighting, heating, ventilation, security and energy consumption.
Remote monitoring allows technicians to identify faults, adjust settings and maintain equipment without travelling to individual stores.
These capabilities can improve efficiency and reduce operating costs.
They can also create cybersecurity risks if equipment is accessible through poorly secured networks or outdated software.
Refrigeration controllers are examples of operational technology, commonly called OT.
Unlike conventional office software, operational technology directly controls physical equipment.
A successful intrusion can therefore produce consequences beyond stolen information or interrupted computer access.
In this case, altered settings may affect the temperatures required to preserve food.
Cybersecurity specialists have warned that exposed industrial controllers can be particularly attractive targets because some were originally designed for reliability and remote maintenance rather than protection against sophisticated online threats.
Food safety and economic consequences
Refrigeration disruptions can have serious consequences for supermarkets and consumers.
Fresh meat, fish, dairy products, frozen goods and other temperature-sensitive foods require controlled storage conditions.
If refrigeration fails for an extended period, retailers may need to remove affected products from sale.
The financial consequences can include food disposal, replacement stock, technical repairs and temporary business disruption.
The October attacks in France reportedly caused substantial food losses.
However, the complete financial cost of the November 2 incidents has not yet been established.
There is also no verified evidence that every affected supermarket sold unsafe food.
Retailers are responsible for checking storage conditions and determining whether products remain suitable for sale.
The wider concern is that malicious interference with connected equipment could disrupt essential food distribution systems.
Authorities investigate possible links
Sweden's national cybersecurity centre is examining the incidents affecting domestic retailers.
Companies in Belgium and Luxembourg are conducting their own investigations.
French authorities continue to examine the earlier attacks.
No organisation has publicly claimed responsibility for the latest disruptions.
Investigators have also not announced a verified attribution to a government, criminal organisation or other group.
Although the incidents occurred in several countries within a short period, their connection remains an open question.
Establishing a common source would require technical evidence, including access logs, network records, compromised software details and other forensic findings.
The current evidence supports reporting widespread refrigeration disruptions and suspected cyber interference, but not identifying a single international attacker.
A warning for businesses worldwide
The incidents highlight cybersecurity risks that extend beyond European supermarkets.
Businesses in Africa and other regions increasingly use internet-connected equipment for food storage, cold-chain logistics, healthcare, manufacturing and energy management.
These systems can be essential to everyday operations.
The disruption of refrigeration equipment demonstrates why cybersecurity planning should include physical infrastructure rather than focusing exclusively on websites, email accounts and financial databases.
Companies may need to review remote-access controls, software updates, network segmentation and procedures for operating equipment safely when digital systems become unavailable.
The events also raise questions about how equipment manufacturers, service providers and retailers share responsibility for securing connected systems.
What happens next
Retailers are continuing technical checks and restoring affected equipment.
Cybersecurity authorities are investigating the incidents and assessing whether the disruptions share a common cause.
Further information will be needed to establish the number of affected stores, the financial losses and the precise methods used by attackers.
The immediate confirmed development is that refrigeration systems at supermarkets in at least four European countries experienced significant disruptions on November 2, with several retailers and technical specialists reporting suspected cyberattacks.
The incidents follow a larger wave of confirmed refrigeration-system intrusions in France.
Together, they demonstrate the potential consequences when digitally connected systems controlling physical infrastructure become vulnerable to malicious interference.
For businesses and regulators, the central concern is no longer limited to the protection of information.
It is also the protection of the equipment and services on which daily commercial activity depends.
