European Supermarkets Face Second Wave of Cyberattacks Targeting Refrigeration Systems

Key points

• Supermarkets in Belgium, Sweden, Ireland, Luxembourg, Estonia, and the Netherlands reported fridge and freezer temperature spikes, with some units reaching 50°C (122°F).
• The attack targeted legacy refrigeration control systems, likely from Danish manufacturer Danfoss, which are often connected to the internet for remote maintenance.
• No group has claimed responsibility, but experts suggest the motive may be ideological or state-sponsored rather than financial, given the lack of ransom demands.
• European cybersecurity agencies are monitoring the incident, with Sweden's national center noting a need to patch exposed operational technology devices.

Background

This is the second major incident in less than a month targeting European grocery supply chains. In October 2026, a similar cyberattack hit hundreds of French supermarkets, causing temperatures to surge and leading to millions of euros in food losses and fires. The recurring nature of these attacks underscores the growing risk to critical infrastructure reliant on legacy, internet-connected systems.

How outlets are covering it

Outlets agree on the scale and impact of the attack but differ on attribution and technical details. CBS News and NBC News emphasize the lack of claimed responsibility and the potential for state-sponsored or ideological motives. CTV News highlights the vulnerability of similar systems in Canada, noting that Danfoss products are sold there, though no Canadian incidents have been reported. BBC focuses on the immediate financial losses, such as a €100,000 loss at one Belgian Delhaize store, and the response from national cybersecurity agencies. All sources confirm the attack targeted refrigeration control systems, but only CTV News explicitly links the vulnerability to older Danfoss models lacking security updates.

Why it matters

The attacks demonstrate how cyber threats can directly impact everyday life by disrupting essential food supply chains. The reliance on legacy, internet-connected industrial hardware creates significant vulnerabilities for critical infrastructure, raising concerns about food security and the resilience of retail operations against digital sabotage.

What to watch

European cybersecurity agencies are investigating the incidents and urging businesses to ensure operational continuity if systems go offline. Companies may need to invest in physical hardware modifications to address vulnerabilities that software updates alone cannot fix. The lack of claimed responsibility leaves the motive unclear, but experts warn that such attacks may become more frequent as hackers exploit unpatched systems.