Supermarket freezers in seven European countries warm up overnight in a suspected cyberattack, three weeks after France’s, the BBC and the Guardian report

Shop freezers across Europe warmed up in the dark. Overnight into Monday, Nov. 2, supermarkets in at least seven countries, Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia and Finland, reported that the temperatures in their fridges and freezers climbed, and several companies said hackers caused it, according to BBC News and the Guardian. The temperatures in several shops reportedly rose as high as 50C (122F), the BBC reported. The attack came three weeks after a similar one on French supermarkets on Oct. 12, according to Euronews.

Belgium appears to have taken the largest hit. Around 40 Delhaize supermarkets in Belgium and Luxembourg felt it, according to BBC News. Euronews, citing the Belgian paper Le Soir, listed some 40 Delhaize Proxy shops, 15 Carrefour Shop & Go stores, 15 Intermarché shops and five Spar locations at Q8 service stations, and counted 75 Belgian stores in all once a butchery group, De Laet en Van Haver, and an Ikea store in Mons joined the list. Belgian media first reported fridges turned up to 17 degrees Celsius, according to Euronews.

The method looks simple. Stephan Moelans, the chief executive of Sabcobel, a Belgian company that operates Delhaize’s refrigeration systems, told the Belga news agency that the units’ evaporators got switched to defrost mode, causing them to warm up, according to BBC News. The BBC reported that his company had worked “all night and morning to disconnect the affected units from the network”. Moelans told Le Soir: “We started mobilising technicians at 1am,” according to the Guardian; 1 a.m. in Belgium equals 4 p.m. PT on Sunday.

Moelans said the fix needs hardware, not only code. Since the French attack, he said, the company had worked to “protect our customers fridges against this vulnerability,” but the units needed physical modifications, not just software updates, according to BBC News. “The simplest solution is to manage the fridges over a secure internet connection. Most of our customers switched to that after the attack in France,” he added, the BBC reported. Euronews quoted him as saying the Belgian attack used exactly the same mechanism as the French one.

Store losses began to add up. A Delhaize branch in Hoeilaart, in Flanders, told the news website Het Laatste Nieuws that it lost €100,000 (£83,500) worth of produce, a figure that did not include losses from closing the shop, according to BBC News. Reporters at a shop north-east of Brussels saw empty fridges and freezers and a sign that read: “Due to cyberattacks, there will be no products on the refrigerated or freezer shelves. We offer our sincere apologies,” according to the Guardian. A Delhaize spokesperson, Sarah De Meester, said the range of fresh and frozen products looked “temporarily somewhat limited” in affected shops, while distribution centres ran normally, the Guardian reported.

Other Belgian chains spoke more bluntly. “It’s a cyber-attack, there is no other reason,” said Mich Vergauwen, a Carrefour spokesperson, according to the Guardian, which reported disruption in about 15 of Carrefour Belgium’s 700 shops. A spokesperson for Colruyt Group, which runs Spar stores in Belgium under a franchise system, told Reuters that five shops had their fridge systems attacked, according to BBC News. Ikea said the attack reached refrigeration at its store in Mons, and a spokesman told Reuters: “we cannot rule out that additional locations may be affected,” the BBC reported. Belgium’s Centre for Cybersecurity told Belga it knew of an incident targeting supermarket refrigeration systems, and the federal prosecutor’s office opened an investigation, according to Euronews.

Sweden reported the hottest readings. One ICA branch in Sjöbo, in the south, wrote on social media: “Our refrigerators and freezers have been hacked overnight and they have set the temperature to 50 degrees,” according to BBC News, which reported that the store closed and later reopened. Another ICA store, in Stockholm, said its freezers broke “due to a 2am cyberattack” and that “everything was destroyed,” according to the Guardian; 2 a.m. in Stockholm equals 5 p.m. PT on Sunday. An ICA spokesperson told the BBC that the incident affected a “small number of ICA stores operating outside ICA’s central network.”

The Coop count differs by source. Coop told the BBC that seven of its 800 Swedish stores felt the attack but that the “situation is currently contained and under control.” The Guardian reported that Coop told the daily Aftonbladet six of its shops got hit. John Billow, head of Sweden’s national cybersecurity centre, told Reuters the country has “quite a lot of exposed operational technology devices” that need updating or patching, according to the Guardian.

Ireland, the Netherlands, Estonia and Finland followed. In Ireland, 13 SuperValu supermarkets felt the attack, and a spokesman for owner Musgrave Group told The Irish Times that a “cyber incident” affected its refrigeration systems, limited to a “specific model” of refrigerator, according to BBC News. The Guardian put that at 13 of SuperValu’s 223 shops, with chilled and frozen products removed from sale. Ireland’s public broadcaster RTÉ News posted on X at 7:22 a.m. PT that the issues at all 13 stores had “now been fully resolved.” In the Netherlands, a spokesperson for the Danish manufacturer Danfoss told public radio NOS that the systems of at least 17 companies, mostly butcher shops and small neighbourhood stores, came under attack overnight, according to the BBC.

In Estonia, the refrigeration firm Kitman Coldtech told the broadcaster ERR that attackers accessed a computer controlling a supermarket chain’s refrigeration and turned the temperature up to 50C, according to the Guardian. “This is very fresh, it happened this morning,” its chief executive, Jann Mutso, said, adding that the response came within minutes and the attack caused no significant damage; the Selver chain said one outlet got hit, the Guardian reported. In Finland, refrigerator malfunctions turned up at some K-stores, and owner Kesko told Helsingin Sanomat that its security experts had begun investigating, according to BBC News.

Officials in Brussels and London reacted. The EU food and agriculture commissioner, Christophe Hansen, called the repeated attacks “a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it,” according to the Guardian. The U.K.’s National Cyber Security Centre said it had begun working with international partners and industry to “fully understand details of an incident,” and no incidents had surfaced in the U.K., according to BBC News. Belgium’s and Sweden’s national cyber-security agencies said they had begun monitoring, the BBC reported.

Nobody has claimed responsibility. The BBC reported that it remains unclear who stands behind the latest apparent attack, and the Guardian reported no claims of responsibility for the French attack either. Tom Hegel of the security firm SentinelOne told Reuters that the lack of financial demands points to sabotage, according to the Guardian. “Retail is an easy target because retail chains run enormous estates of refrigeration controllers, building management systems, door access panels and point-of-sale gear,” he said. The Guardian also reported that authorities fear government-sponsored hybrid attacks after Russia’s 2022 invasion of Ukraine; no official source this desk read tied Monday’s attack to any state.

The weakness predates Monday. Patrick Lamplmair of the security firm Tributech said, according to the Guardian: “Thousands of these controllers were still reachable from the internet after the French attack.” He added: “A few commands to a temperature controller can destroy stock overnight and close stores.” Euronews reported that Danfoss, which supplied software for the refrigeration systems in both the French incident and the latest one, said customers who had not updated their software got hit. The Guardian reported that Danfoss had identified some security flaws last year and had “long recommended” that customers install updates.

The French case still lacks an author. In October, according to the Guardian, hackers seized cooling units in as many as 700 supermarkets at chains including Intermarché, Coopérative U, Carrefour, Leclerc and Monoprix, pushing them from as low as −27C to well over 50C, with food losses estimated in the tens of millions of euros. The Paris prosecutor’s office opened a formal investigation, and France’s national cybersecurity agency, ANSSI, later reported that attackers also targeted supermarkets using controllers from two other companies, the Guardian reported. In the U.S., authorities have begun investigating what caused refrigeration malfunctions at a number of American military bases in August, and they have worked with French officials to examine whether the incidents could link up, according to BBC News. Seems News covered the French attack on Oct. 12.

Seems News could not reach the retailers, Sabcobel or Danfoss for this report. It relies on BBC News, the Guardian, Euronews and posts on X, with times converted to Pacific time (UTC−8) and to local time where the sources gave one. The Associated Press blocked this desk’s fetch, so its report appears nowhere in the story, and quotes from Reuters, Belga, Le Soir, NOS, ERR and other outlets come secondhand through the BBC, the Guardian and Euronews.