Cyber-Attack Targets Refrigeration Systems at European Supermarkets

"are a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it." — Christophe Hansen, EU Agriculture and Food Commissioner

Countries and retailers affected: Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden; SuperValu, ICA Sweden, Ikea

On November 1, supermarket retailers across at least nine European countries reported a cyber-attack that targeted refrigeration systems and destroyed food stock. The countries named in official statements and reporting were Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden. Among the retailers explicitly identified in coverage were Ireland-based SuperValu, Sweden’s ICA Sweden and Ikea outlets in Belgium.

SuperValu told The Irish Times that the “cyber incident” affected a “specific model” of refrigerator used in its stores; the retailer removed chilled and frozen products from shelves in 13 stores as a precaution. A Swedish store under ICA Sweden posted that “its fridges and freezers had been hacked and their temperature set at 50°C,” according to reporting in The Guardian. Agence France-Presse on November 3 cited an Ikea spokesperson saying a Mons, Belgium outlet had seen freezer temperatures rise after a cyber-attack.

Technical pattern and October parallel: Danfoss and Copeland incidents

At the time of reporting there was no official confirmation of how the November attacks occurred or who was responsible. Journalists and officials noted that the incident “appears to be similar in nature” to an attack in October 2026 against refrigeration systems providers Danfoss and Copeland. That earlier operation resulted in hackers changing temperatures on internet-connected refrigerators across several supermarket chains in France. In the current wave, refrigerators were reportedly programmed to reach as high as 50°C (122°F), ruining the food stored inside.

Sweden’s National Cyber Security Centre: monitoring and cross-border contact

Sweden’s National Cyber Security Centre (NCSC) published a release on November 2 saying it was monitoring incidents affecting freezer and refrigeration systems in the grocery trade. “The centre is in contact with affected businesses and also has exchanges with its counterparts in several Nordic and other European countries,” the agency wrote, indicating ongoing coordination at the national and regional level as the situation unfolded.

UK impact and NCSC statements: awareness and warnings about AI-enabled threats

On November 3 reports also emerged that businesses in the UK food supply chain had been impacted. NCSC chief executive Richard Horne told the BBC’s ‘Today’ program that the agency is aware of "a couple of instances where vulnerable technology had been exploited in the UK." Horne added that potentially affected companies have been alerted about the threat.

The NCSC’s public comments coincided with the agency’s annual review, which warned that “AI-powered malware is strongly expected to feature in ransomware attacks on the UK’s critical national infrastructure by 2028.” Those warnings framed the November events against a broader prediction of increasingly automated and AI-augmented attack techniques.

How retailers, policymakers and technologists are responding

• Retailers and procurement teams: SuperValu’s decision to remove chilled and frozen products from 13 stores exemplifies an immediate operational response — isolating potentially compromised units and taking stock off sale. Retailers operating common refrigerator models will likely inventory affected units and seek vendor guidance for firmware, isolation, or replacement.
• Policymakers and EU agencies: Christophe Hansen said the incidents “will be discussed at the next meeting of its Security College to assess retailers’ contingency plans and their ability to respond to incidents,” signaling planned high-level review of contingency planning and cross-border coordination.
• Technologists and security teams: Security practitioners were warned by industry voices about a growing trend. Amir Preminger, CTO of Claroty, said: “This second wave of attacks on refrigeration systems in Europe highlights a growing trend: threat actors are increasingly targeting widespread, high-impact disruptions to essential services. Heightened geopolitical tensions have driven a surge in activity targeting critical infrastructure, while AI technologies enable attackers to rapidly scan networks for vulnerabilities and weaknesses in access controls.”

Officials and industry spokespeople agreed on at least two clear facts: food products were ruined after refrigeration units were driven to temperatures as high as 50°C, and the attacks followed a similar pattern to October incidents that targeted Danfoss and Copeland systems. Beyond that, key questions remain open — how the attacks were executed, who is responsible, and whether further waves will target other points in the food supply chain. The November incidents have already prompted cross-border contact between national cyber centres and a planned Security College discussion, suggesting the immediate focus will be containment, retailer contingency assessment and firming defenses around internet-connected refrigeration systems.

Source: https://www.infosecurity-magazine.com/news/cyber-refrigeration-supermarkets/