European Grocery Stores Suffer Millions in Losses After Hackers Remotely Override Refrigeration Systems
Hackers have targeted supermarket refrigeration networks across Europe, remotely raising temperatures in commercial display units and cold-storage rooms to as high as 50 degrees Celsius. The cyberattacks spoiled food supplies worth millions of euros, forcing retailers to discard large quantities of inventory. kursors.lv reported that the attacks affected multiple major supermarket chains, including Delhaize, Carrefour, Spar, ICA, and Coop.
The incidents follow a pattern observed since October. France bore the brunt of an early wave that struck between 500 and 700 supermarket refrigeration units, according to la.lv. Hackers targeted roughly 300 Intermarché or Netto locations, more than 100 Cooperative U stores, and multiple E. Leclerc outlets. On November 2, a fresh wave of attacks hit commercial stores in Belgium, Luxembourg, Estonia, the Netherlands, Sweden, and Ireland, as detailed by la.lv and kursors.lv.
Invasion of Retail Freezers Spreads Across Estonia and Beyond
In Estonia, a major food retailer fell victim on the morning of November 2 when criminals accessed a computer used for remote management of the store’s refrigeration equipment. Jans Mutso, head of refrigeration system manufacturer and distributor Kitman Coldtech, stated that the intruders raised the temperature in a display refrigerator to 50 degrees Celsius, as noted by DELFI. DELFI also reported that state defense information confirmed attempted cyberattacks on refrigeration systems inside Latvia.
A Latvian warehouse suffered a minor cyber intrusion that caused limited damage because the attack was spotted and neutralized in time, CERT.lv informed TV3 Ziņas, via DELFI. In Belgium, about 40 Delhaize stores sustained damage, with one location discarding roughly 100,000 euros worth of food, according to kursors.lv. Store employees reported an inability to lower temperatures or restore normal operations through standard controls.
Cyber Experts Warn of State-Backed Tactics and Outdated Software
Security analysts have not yet identified the culprits behind the network intrusions. Marta Ribčinska, a cybersecurity expert and founder of Ygreky, suggested that state-sponsored groups could be behind the actions because the attackers show no obvious financial gain, aiming instead to cause civil unrest and disruption, according to la.lv. Ribčinska added that refrigeration units remain attractive targets because exploitation details are easily accessible online, and many retailers fail to secure cooling equipment properly.
Pavlina Pavlova, founder of the cybersecurity organization Critical Cyber, warned that part of the equipment hit in France consisted of older models that no longer receive security updates despite known vulnerabilities dating back to 2025, as reported by la.lv. Pavlova noted that these operational technology systems remain reachable from the outside while lacking adequate defenses.
Recommended Steps for Securing Connected Equipment
Vilnis Kibermanis, head of the technical solutions expert team at Bite Latvija, emphasized that businesses and households must review the security of internet-connected devices. Kibermanis outlined five key defensive measures:
- Change default credentials: Replace manufacturer-set passwords immediately on cameras, routers, and industrial controllers, and remove unused remote access accounts.
- Implement multifactor authentication: Enable MFA for administrative platforms, noting that Bite Latvija and SKDS survey data shows 33% of Latvian businesses currently utilize two-factor authentication, up from 24% a year prior.
- Maintain software updates: Apply security patches across all connected hardware, and replace devices no longer supported by manufacturers.
- Segment critical networks: Isolate connected and operational technology (OT) equipment from general IT infrastructure to contain potential breaches.
- Audit connected inventories: Keep an inventory of network-connected equipment and monitor for unusual logins, configuration changes, or other deviations before incidents disrupt business operations.
Frequently Asked Questions About Supermarket Cyber Incidents
Which retail chains were affected by the recent refrigeration attacks?
According to kursors.lv, the hacks hit approximately 40 Delhaize stores in Belgium and Luxembourg, several ICA and Coop stores in Sweden, 13 SuperValu stores in Ireland, 15 Carrefour and five Spar stores in Belgium, with similar problems also noted in the Netherlands, Estonia, and Finland.
What was the highest temperature recorded in the compromised units?
kursors.lv and DELFI reported that hackers remotely raised temperatures inside commercial display units and refrigerated cabinets to 50 degrees Celsius, destroying large quantities of food.
Did Latvian retailers suffer major financial losses from the intrusions?
DELFI reported via CERT.lv that a Latvian warehouse suffered an attack that resulted in minor losses because the intrusion was identified and neutralized quickly.
Who has claimed responsibility for targeting the European supermarket freezers?
la.lv noted that no individual or group has claimed responsibility, and official investigators have not yet identified a perpetrator for the multi-country incidents.
Earlier coverage: Hackers target European supermarket refrigeration systems