A recent series of cyberattacks targeting major European grocery chains has demonstrated how remote digital exploits can disrupt physical daily life.
The latest wave struck early Monday, when stores in Belgium, Luxembourg, Sweden, Ireland, Estonia, the Netherlands and Finland found their refrigeration systems warming up. It came three weeks after a similar attack hit hundreds of supermarkets across France.
No group has claimed responsibility, and investigators have not said who is behind the attacks or whether the two waves are linked.
The European Commission is examining supermarkets’ preparedness for cyberattacks following the latest incidents, including whether retailers have adequate backup systems and contingency plans, EU Agriculture and Food Commissioner Christophe Hansen told Politico on Monday.
The issue is also expected to be discussed by the Commission’s Security College, he said.
The first attack came on the night of Oct. 11.
Refrigeration systems at supermarkets across France were switched into defrost mode while stores were closed, warming cabinets full of fresh and frozen food.
Intermarche, Netto, Cooperative U, Carrefour, Monoprix and E.Leclerc stores were among those affected.
French Finance Minister Roland Lescure told the National Assembly that about 700 of the country’s 10,000 supermarkets had been hit.
The Paris prosecutor’s office opened an investigation into what it called a large-scale cyberattack on connected refrigerators, citing food losses and fires.
“Targeting equipment essential to the preservation of fresh products and to the food supply of the French people is extremely serious and unprecedented. It is unacceptable,” Cooperative U CEO Dominique Schelcher wrote on X.
The second wave hit in the early hours of Nov. 2.
Delhaize said an “IT incident” had affected refrigeration at several dozen stores in Belgium and Luxembourg.
Irish wholesaler Musgrave said 13 of its 223 SuperValu stores were affected and that chilled and frozen products were removed as a precaution.
An ICA store in Sjobo, southern Sweden, told customers on social media that its fridges and freezers had been set to 50 degrees Celsius (122 degrees Fahrenheit).
Belgium’s federal prosecutor’s office has opened a criminal investigation, while Sweden’s National Cybersecurity Center said it was sharing information with Nordic and European partners.
Large supermarkets rarely run each fridge on its own.
A central controller sets the temperatures and defrost schedules for every cabinet and cold room in the store.
Many of these controllers are connected to the internet so refrigeration contractors can monitor them and fix faults without sending a technician.
France’s national cybersecurity agency ANSSI said it was aware of “numerous compromises” of remote controllers made by Danish manufacturer Danfoss, later adding systems from US-based Copeland and its Dixell brand.
The alert says leaving management interfaces directly exposed on the internet goes against basic security practice.
Danfoss has said most of the affected units were older models that no longer receive software or security updates.
The weaknesses were documented before the attacks.
In August, researchers at industrial cybersecurity firm Claroty reported flaws in a Danfoss controller model, including a hidden daily code that could be used to get around the administrator password.
Using a public internet-scanning tool, they found over 2,700 Danfoss systems reachable online.
“You can just log in and change the temperature. Anybody can do it, easily scriptable,” British security researcher Kevin Beaumont wrote on Cyberplace, a decentralized social media platform hosted on the Mastodon network.
Defrost mode is a routine setting that briefly warms a unit to melt built-up ice. Left running for hours, it heats the cabinet instead.
In some of the November cases, the target temperature was simply raised.
Both waves struck at night, when few staff were on hand to notice.
That remains unknown.
No group has claimed responsibility for the attacks, and no ransom demand or theft of customer data has been publicly reported.
Financially motivated attacks are a persistent threat to the food industry.
The Food and Agriculture Information Sharing and Analysis Center (Food and Ag-ISAC), a US-based industry nonprofit, describes ransomware as the sector’s most costly cyber threat.
It recorded a 62% increase in ransomware incidents against food and agriculture organizations this year compared with the same period in 2025.
But the absence of a known ransom demand in the supermarket attacks leaves the motive unclear.
Possible explanations range from deliberate disruption or hacktivism to attackers exploiting vulnerable systems simply because they are accessible, but there is currently no evidence establishing any of those motives.
Food and Ag-ISAC says ransomware groups frequently operate opportunistically, scanning for exposed and unpatched systems rather than selecting victims solely because of the industry they operate in. It has also warned that hacktivist groups are increasingly targeting internet-accessible systems that control physical operations.
Attributing such attacks can itself be difficult. France’s CERT-FR said in its latest cyber threat assessment that the traditional boundaries between state-backed and cybercriminal actors continued to blur in 2025, further complicating efforts to determine who is responsible for malicious cyber activity.
For now, authorities have presented no evidence linking the supermarket attacks to a state, criminal organization or hacktivist group.
Grocery chains have faced cyberattacks before, though mostly on their computer systems.
In 2021, Swedish chain Coop temporarily closed most of its roughly 800 stores after a ransomware attack on US software firm Kaseya knocked out its checkout tills.
In 2025, a ransomware attack on British retailer Co-op disrupted deliveries and left some shelves empty.
Attacks on refrigeration are rarer. In a technical bulletin last year, Danfoss described incidents at stores using its controllers in Russia and Israel in 2022.
In the US, at least six military commissaries — grocery stores on military bases — reported freezer malfunctions in late August, including one where equipment switched into defrost mode, with the Pentagon investigating the incidents as a suspected cyberattack.
Officials say Europe’s food supply is not at risk.
The main danger would be warmed products going on sale unnoticed, which retailers say they have prevented by discarding or withdrawing affected goods.
Lescure told lawmakers there was no risk to France’s food supplies, but said the attack “touches the heart of our food security.”
Hansen said in Monday’s statement that food security was not threatened for now, but that the food waste and the impact on businesses were very real.
Most of the cost falls on retailers, many of them independently owned stores, which lose their stock and must pay for repairs.
In some French stores, overheating equipment caught fire.
news_share_descriptionsubscription_contact
contact_the_ombudsman
is_there_an_error_in_this_story
