Europe’s grocery supply chain has been hit by a second major cyberattack in a matter of weeks, with hackers once again able to remotely force supermarket refrigeration units into defrost mode and wipe out large volumes of fresh and frozen stock overnight.
The latest attack struck supermarket chains in Belgium and Sweden on Sunday night, with reports on Monday morning suggesting stores in Ireland, Estonia, and the Netherlands were affected too. In Belgium, refrigeration fitter Sabcobel said at least twenty of its units had been compromised across chains including Delhaize, Carrefour, and Spar, while in Sweden, ICA and Coop both reported refrigerators and freezers malfunctioning across multiple stores. Photos from affected locations showed staff carting out shopping trolleys full of spoiled goods, and ICA Kvantum said on Facebook that it was working hard to get its systems back online.
The method mirrors an “unprecedented” attack that hit hundreds of French supermarkets just weeks earlier, when hackers tricked refrigeration control panels into running a continuous defrost cycle instead of their usual two-hours-a-day setting, pushing internal temperatures to around 50°C. Intermarché, Netto, Carrefour, Monoprix, E.Leclerc, and Coopérative U were all caught up in that incident, with roughly 150 to 400 stores affected depending on the retailer. Intermarché’s owner, Les Mousquetaires, said its fridges stayed at 50°C for six hours overnight, forcing the chain to discard all the affected stock to avoid health risks, and some stores also reported fires breaking out as a result of the overheating units. The Paris prosecutor’s office opened an investigation into that attack, and French authorities said they were coordinating with European counterparts given the risk of the hack spreading to other countries, a warning that now appears to have borne out.
Most supermarket cold chains in Europe run on centralized control panels that manage every fridge and freezer in a store from one place. These panels are deliberately connected to the internet so that maintenance contractors can monitor temperatures and intervene remotely when something goes wrong — the same connectivity that hackers appear to have exploited to push units into their defrost state instead. In the French case, researchers pointed to vulnerabilities in refrigeration control software from Danish manufacturer Danfoss. Security analysts have said the Belgium and Sweden incidents follow the exact same playbook, which has raised questions about why vulnerable systems weren’t secured after the first wave of attacks. Sabcobel’s CEO said the company had worked hard to protect its units since the French attack, but that fixing the underlying issue requires physical changes to the hardware; switching affected fridges to secure, isolated internet connections has been the stopgap most retailers have adopted in the meantime.
Europe’s food commissioner condemned the French attack at the time, saying food security needs far more attention and that the weaponisation of food has become a real threat. The financial toll from the two incidents combined is likely to run into millions of euros once spoiled stock, lost sales, and the cost of hardening systems against repeat attacks are all accounted for.
The timing is notable. Hackers have had an unusually disruptive run through the back half of 2026, with large-scale breaches hitting everything from crypto exchanges to cloud infrastructure providers in the same stretch, while major software vendors have scrambled to patch vulnerabilities being actively exploited in the wild, including a critical Brotli decoder bug that forced emergency fixes across the internet. October alone saw enough incidents that tech executives began referring to it as a “Black October” for cybersecurity, with the CEOs of Salesforce and Shopify both publicly flagging just how bad the month had been, and national cybersecurity agencies issuing fresh vendor-specific warnings of their own. Attacks that compromise authentication and identity infrastructure, like the one that recently rattled markets around India’s eMudhra certificate hack, have added to the sense that the systems underpinning everyday commerce are under sustained pressure.
It is still unclear who is behind the supermarket attacks or what the underlying motive is, and investigators have not confirmed whether AI tools were used to identify or exploit the vulnerable refrigeration systems. But the incidents land at a moment when AI-assisted hacking is increasingly being blamed for lowering the bar for this kind of attack, with officials elsewhere noting that AI models are letting attackers compromise systems “with ease” even without specialized technical skills. For supermarket chains, the twin attacks are likely to force a much harder look at how much of their physical infrastructure, from refrigeration to point-of-sale systems, is left exposed to the open internet.