Staff at the ICA store in Sjöbo, in southern Sweden, found the freezers running at 50 degrees Celsius when they opened on Monday morning. The shop closed to clear them out. “Our refrigerators and freezers have been hacked overnight and they have set the temperature to 50 degrees,” the branch wrote on social media.
It was not an isolated shop. Across Belgium and Sweden, and in a handful of stores in Ireland, refrigeration and freezer systems rose to temperatures normally associated with an oven, and the retailers’ first response was to suspect a remote intrusion rather than a mechanical fault.
At least 40 Delhaize supermarkets and 15 Carrefour stores were affected in Belgium, according to the two chains and Belgian media reports. In Sweden, a small number of ICA stores operating outside the chain’s central network were hit, along with seven of Coop’s 800 shops. Thirteen SuperValu stores in Ireland reported the same pattern. “There has been a cyberattack and all our freezers reached 50C,” Engla Ingwall, a sales manager at an ICA franchise store in Stockholm, told Reuters, adding that the change happened around 2am and was noticed hours later.
The retailers described the events in the careful language of unresolved incidents. Delhaize told Belgian media that a “computer incident” had occurred overnight at the 40 shops. Carrefour said it was “currently analysing” what happened at its Belgian stores. A Coop spokesperson said the situation was contained, and ICA said it was supporting the affected branches. Nobody has claimed responsibility, and no retailer has said publicly how the systems were reached.
The commercial damage is measured in thrown-away stock. Local media reported thousands of euros of food discarded at individual stores, with staff emptying cases and cleaning them before reopening. For a grocery chain the loss is small against a quarter’s revenue; for a franchisee running one shop it is a week’s margin.
The pattern is familiar because it happened in France last month. On the night of October 12, hundreds of French supermarkets, including up to 200 Intermarché stores, found their refrigeration units heating instead of cooling. Bloomberg reported on one of them: Jérémy Béziaud, manager of an Intermarché in Normandy, arrived to find freezers at 40 degrees and the ventilated cold room for fish at 70. French investigators treated that wave as a cyberattack. Whether this week’s incidents share an author is not established, and the possibility of a copycat is as live as the possibility of a single campaign.
The technical shape of the target explains the repetition. Supermarket refrigeration is no longer a compressor and a thermostat. It is a network of controllers, usually supplied and maintained by contractors, reporting over cellular or broadband gateways to a monitoring platform that a facilities team watches from a screen. Those controllers were designed for reliability, not for authentication, and many installations still accept default credentials or run on protocols written before anyone thought the freezer would be reachable from the internet. A single compromised account at a maintenance provider can reach every site that provider serves.
That is what makes grocery an attractive target and a difficult one to defend. A chain may run hundreds of small sites, each with a modest IT budget and a manager whose job is stock, not security. The equipment is often the property of a third party. The consequence of failure is not a data breach that can be disclosed at leisure but food that has to be destroyed by law, and a shop that cannot trade.
Regulators have been moving in this direction for several years. Under the European Union’s NIS2 directive, large food distributors sit inside the perimeter of entities expected to meet baseline cyber requirements and report significant incidents, which puts refrigeration squarely in scope for the first time. Member states have been transposing the rules on different timetables, and enforcement against a supermarket group would be a test of whether the perimeter means anything.
Two readings of this week are available, and the evidence does not yet choose between them. The first is that a criminal group has found a cheap way to cause expensive disruption, and that the technique will spread because it works. The second is that the incidents are less coordinated than they look: a common class of vulnerable controller, discovered by more than one actor, producing similar symptoms in different countries within weeks.
Analysts said the second reading is more likely in the short term and more worrying in the long one, because it implies a large installed base of equipment that cannot be patched quickly. Refrigeration controllers last a decade or more, and replacing them across thousands of stores is a capital project that no retailer wants to schedule.
For shoppers in Belgium and Sweden, the visible result was a closed aisle and a hand-written sign. For the industry, the lesson is that the cold chain now depends on a login.
