European Retailers Report Second Wave of Freezer Hacks in Belgium, Sweden, and Ireland

Key points

• Ahold Delhaize reported an 'IT incident' affecting dozens of stores in Belgium and Luxembourg, with one branch in Hoeilaart estimating losses of €100,000.
• Swedish chains ICA and Coop confirmed that a limited number of stores were affected; one ICA location in Sjobo posted on social media that temperatures had been set to 50C.
• SuperValu, Ireland’s third-largest supermarket chain, stated that a specific model of refrigeration system was impacted at 13 of its 223 stores.
• Estonian technology supplier Kitman Coldtech confirmed that at least one supermarket chain in the country experienced temperature spikes to 50C.
• The attack follows a similar incident in October in France, where hackers remotely controlled cooling units in up to 700 supermarkets, causing fires and massive food losses.

Background

In October 2026, a coordinated cyber-attack targeted internet-connected refrigeration controllers in approximately 700 French supermarkets. The breach exploited outdated firmware and default passwords, causing temperatures to rise from -27C to over 50C. This resulted in massive food spoilage, fires, and estimated losses of tens of millions of euros. The Paris prosecutor’s office opened a formal investigation, and French Prime Minister Sébastien Lecornu instructed the national cybersecurity agency, ANSSI, to investigate. EU officials have since emphasized the need for stronger cybersecurity measures for critical infrastructure, noting that the exploitation of vulnerabilities in essential networked systems is a new reality.

How outlets are covering it

The Guardian and BBC focus on the immediate impact in Belgium and Sweden, highlighting specific store closures and food waste. CBS News provides a broader European context, noting that the incidents are the second in less than a month and emphasizing the vulnerability of interlinked infrastructure. Al Jazeera expands the geographic scope, including Ireland and Estonia, and quotes Swedish cybersecurity officials about exposed operational technology devices. All sources agree that no group has claimed responsibility, but they differ in emphasis: The Guardian and BBC highlight the financial losses and specific retailer responses, while CBS News and Al Jazeera focus on the systemic vulnerabilities and the need for physical modifications to refrigeration units.

Why it matters

This incident underscores the growing threat to critical infrastructure, particularly in the food supply chain. The repeated targeting of refrigeration systems highlights the risks associated with internet-connected industrial controllers and the potential for significant economic and social impact. As retailers and governments respond, the incident may lead to increased scrutiny of cybersecurity measures in the retail sector and a push for more robust protection of essential services.

What to watch

National cybersecurity agencies in Belgium and Sweden are monitoring the incident, and retailers are working to restore affected systems. Experts are calling for immediate updates to firmware and physical modifications to refrigeration units to prevent future attacks. The Paris prosecutor’s office is continuing its investigation into the October attack, and EU officials are likely to push for stronger cybersecurity standards for critical infrastructure. The lack of a claimed responsibility for the attacks adds to the uncertainty and may lead to further scrutiny of potential state-sponsored or criminal actors.