Cyberattacks Disrupt Supermarket Refrigeration Across Europe

Cyber incidents disrupted refrigeration systems at businesses in several European countries overnight from November 1 to 2, with some retailers removing chilled and frozen food as a precaution. The incidents have not been publicly linked to a single operation, and no group has claimed responsibility.

In Belgium, Delhaize reported problems at several dozen stores, while Carrefour said 15 of its more than 700 locations were affected. In Ireland, Musgrave confirmed disruption at 13 SuperValu stores and said refrigerated and frozen products were withdrawn. Reports also described affected shops in Sweden and Estonia. In the Netherlands, 17 businesses were affected, mostly butcher shops and smaller retailers, rather than major supermarket chains, according to AP and Dutch reporting.

The scale varies by country and by report, and not every reported temperature problem has been confirmed as a cyberattack. Investigators have not established whether the November incidents were connected to an earlier attack in France, where refrigeration systems at several hundred stores were affected in October.

Connected equipment creates exposure

Retailers use internet-connected refrigeration controls to monitor equipment remotely. But systems accessible online can be vulnerable if they are poorly secured, run outdated software or use default passwords. France’s national cyber agency, CERT-FR, warned in October about exposed remote controllers and advised limiting access to protected networks or VPNs, updating firmware and changing default credentials.

Cybersecurity expert Marta Rybczynska told Euronews that the equipment may be targeted because it can be easy to reach and manipulate, while the motive remains unclear. Pavlina Pavlova said older controllers that no longer receive security updates are particularly vulnerable.

Pavlova also warned that artificial intelligence could make it faster to identify and exploit weaknesses. There is no public evidence that AI was used in these incidents, and investigators have not announced an attribution.