Pirates Turn European Grocery Freezers Into Ovens

Cybercriminals have shifted their focus from data theft to physical infrastructure, targeting refrigeration units in major European retail chains. By remotely altering temperature control settings, attackers converted cooling appliances into heating devices, causing direct material losses through spoiled goods without stealing any information. This development highlights a new vector for digital threats that bypass traditional computer networks to impact operational hardware.

Scope of the Retail Attacks

The incidents affected stores in Belgium, Sweden, Luxembourg, Ireland, and Estonia. Security experts warn that these operations could expand further because they target operational systems directly managing food storage conditions rather than standard IT assets. In Belgium, outlets belonging to the Delhaize chain faced attacks on their cooling infrastructure. A specialist noted that hackers switched evaporator units into defrost mode, a function normally used to remove ice buildup but which caused temperatures to rise instead of maintaining coldness.

Similar disruptions occurred at ICA stores in Sweden, where freezer temperatures climbed to approximately 50 degrees Celsius. In one Belgian butcher shop, refrigerator heat reached 18 degrees Celsius, ruining meat products valued at around 15,000 euros. The attacks were not limited to small businesses; they extended to well-known brands across the continent. Fifteen Carrefour stores in Belgium were impacted alongside Delhaize locations, while five Colruyt group shops also suffered breaches.

Widespread Damage Across Chains

In Sweden, seven Coop stores experienced system manipulations, along with a limited number of ICA branches. SuperValu in Ireland reported that 13 of its stores were hit by the same type of intrusion. An IKEA store in Belgium was also targeted, though technical teams in Estonia managed to contain an attack within minutes, preventing significant damage.

These events follow a wave of similar cyberattacks in France during October, where hundreds of large supermarkets and independent shops had their cooling systems tampered with, pushing some unit temperatures to nearly 50 degrees Celsius. Technical reports indicate that several compromised systems in Europe rely on temperature control technology from the Danish company Danfoss, whose solutions were also present in the French incidents. Danfoss confirmed it is working with clients to address security issues and implement measures to mitigate risks associated with these breaches.

Investigations and Official Warnings

The Belgian Cybersecurity Center acknowledged awareness of the attacks, and the federal public prosecutor has launched an investigation to identify the perpetrators and clarify circumstances. No group has claimed responsibility so far, and there is no confirmed link between these recent events and the earlier attacks on French retailers.

European Commissioner for Agriculture Christophe Hansen warned that repeated incidents pose a threat to food supply chains and could undermine consumer confidence in product safety. The attacks underscore vulnerabilities in internet-connected industrial and commercial systems, demonstrating that breaches can move beyond service disruption or data leaks to cause tangible financial losses through product destruction.