More than 115 stores across six European countries reported refrigeration failures after attackers remotely changed temperature settings, according to reporting by BleepingComputer.
Scope and immediate effects
Retailers and media reports described a wave of refrigerator and freezer disruptions that struck dozens of supermarkets, butcher shops and neighborhood stores overnight. In some locations hackers remotely shut down refrigeration units or activated defrost cycles, causing temperatures to rise and forcing managers to discard cooled and frozen stock. An ICA store manager told TV4 that temperature settings had been changed overnight to +50°C (122°F) and could not be modified, requiring discarded frozen food.
Which supermarket chains and countries were affected
- More than 115 stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia were reported affected.
- Chains that acknowledged refrigeration issues to BleepingComputer include ICA (Sweden) — at least 4 locations; Coop (Sweden) — 7 locations; Ahold Delhaize (Belgium and Luxembourg) — around 40 locations; Carrefour (Belgium) — 15 locations; Spar Colruyt (Belgium) — 5 locations; Intermarché (Belgium) — around 15 locations; SuperValu (Ireland) — 13 stores; and Selver (Estonia) — 1 store.
- In the Netherlands, at least 17 butcher shops and neighborhood stores were affected. Additional Belgian locations included an Ikea superstore in Mons, grocery shops and chocolate stores.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleRetailers' statements and operational responses
Retail spokespeople told BleepingComputer they were supporting affected stores and working to contain the incident. ICA’s press officer stated: “We can confirm that we have been informed of an incident overnight affecting a small number of ICA stores operating outside ICA’s central network. The incident impacted the stores’ refrigeration and freezer systems. ICA is currently supporting the affected stores in managing the situation.”
Ahold Delhaize said: “We have identified an IT incident affecting the refrigeration systems in several dozen stores,” and that the company “immediately took the necessary measures to keep our stores operational.” RTL reported that Ahold Delhaize warned managers by SMS around 4 a.m. and that some stores used refrigerated trucks to preserve stock.
Coop, one of Sweden’s largest grocery chains, told BleepingComputer that “a small number of stores were affected overnight into Monday - specifically 7 out of more than 800 stores,” adding: “The situation is currently contained and under control. The issues have ranged from completely shut-down refrigerators and freezers to partially functioning units, and in one case, the system beginning to generate heat.”
Carrefour described a limited impact: “The impact at Carrefour is very limited: currently 15 of our 700 stores are affected, both in Flanders and Wallonia,” and added that “Not a single hypermarket is among them. All stores remain open because it only concerns a few refrigeration units, mainly freezers. Quick action was taken so that all stores can stay open.”
A representative of the Colruyt Group told BleepingComputer that “there is an impact on the refrigeration systems at around five Spar stores.” The company added: “These stores are operated by independent entrepreneurs who have their own refrigeration systems. We are currently doing everything we can to resolve the issue.”
Technical clues: vendors, vulnerabilities and remediation limits
RTL identified Sabcobel as the vendor of refrigeration systems across several impacted locations. Sabcobel’s director, Stephan Moelans, told RTL that technicians began disconnecting affected installations since 1 a.m. and attributed the disruption to remotely activated defrost functions.
Moelans said the attacker “leveraged the same vulnerability used in similar attacks last month in France.” BleepingComputer’s reporting referenced last month’s refrigerator attacks in France, which impacted hundreds of stores using Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB refrigeration controllers that were compromised by remote attackers who set them to defrost mode.
On remediation, Moelans cautioned that “a simple software update is not enough, as refrigerators also require physical modifications,” and recommended that the “simplest solution is to manage the refrigerators via a secure internet connection. Most of our clients have adopted this solution since the attack in France.” BleepingComputer has contacted Sabcobel for more information and was awaiting a response at the time of reporting.
How technologists, retailers, and regulators are likely to respond
- Technologists and security teams: Expect attention on the specific controllers cited by prior attacks (Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB) and on the network paths that allow remote activation of defrost functions, since vendors and technicians have reported disconnecting installations and saying physical changes are needed.
- Retailers and procurement leaders: Independent-store models and third-party refrigeration systems complicate centralized patching: Colruyt noted Spar stores are operated by independent entrepreneurs who maintain their own systems, underscoring disparate ownership and maintenance responsibility across affected locations.
- Regulators and incident responders: The cross-border nature of the incident — spanning Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia — and the uncertain scope of coordination will likely prompt inquiries into supply-chain exposure and standards for remotely managed critical store equipment.
It remains unclear whether the incidents represent a coordinated campaign or multiple, individually targeted intrusions. Retailers have taken immediate steps — from SMS alerts and refrigerated trucks to disconnecting infected systems — but vendors and operators warn that fixes may require physical changes as well as secure networking. The question now is whether those fixes can be implemented quickly and widely enough to prevent a fresh wave of disruptions.
