Cyberattacks warm supermarket fridges across seven European countries

Grocery chains in Belgium, Luxembourg, Sweden, Ireland, Estonia, the Netherlands and Finland found their refrigeration equipment heating up in a second wave of cyberattacks early on Monday, Turkey's state-run news agency Anadolu Agency reported.

The attacks came about three weeks after a similar wave hit hundreds of supermarkets in France.

No group has claimed responsibility, and investigators have not said who is behind the attacks or whether the two waves are connected.

EU Agriculture and Food Commissioner Christophe Hansen told Politico on Monday that the European Commission is examining whether supermarkets are prepared for such attacks, including whether they have adequate backup systems and contingency plans.

The France attacks began on the night of Oct. 11, when refrigeration systems in stores across the country were switched into defrost mode while the shops were closed, leaving cabinets of fresh and frozen food warming.

French Finance Minister Roland Lescure told the National Assembly that about 700 of the country's 10,000 supermarkets had been hit.

The Paris prosecutor's office opened an investigation into what it called a large-scale cyberattack on connected refrigerators, citing food losses and fires.

Cooperative U CEO Dominique Schelcher wrote on X that the attack was "extremely serious and unprecedented."

The second wave struck in the early hours of Nov. 2, and Irish wholesaler Musgrave said 13 of its 223 SuperValu stores were affected, with chilled and frozen products removed as a precaution.

Belgium's federal prosecutor's office has opened a criminal investigation, and Sweden's National Cybersecurity Center said it was sharing information with Nordic and European partners.

Large supermarkets usually control refrigeration through a central controller that sets temperatures and defrost schedules for every cabinet and cold room, and many of these controllers can be reached over the internet so contractors can fix faults remotely.

France's national cybersecurity agency ANSSI said it had seen numerous compromises of such controllers made by Danish manufacturer Danfoss, and later added systems from US-based Copeland and its Dixell brand.

Danfoss said most of the affected units were older models that no longer receive software or security updates.

Researchers at industrial cybersecurity firm Claroty reported flaws in a Danfoss controller model in August, including a hidden daily code that could be used to bypass the administrator password.

Using a public internet-scanning tool, the researchers found more than 2,700 Danfoss systems reachable online.

Food and Agriculture Information Sharing and Analysis Center, a US-based industry nonprofit, said ransomware against food and agriculture organizations rose 62 percent this year compared with the same period in 2025, but no ransom demand or theft of customer data has been publicly reported in the supermarket attacks.

Grocery chains have faced cyberattacks before, mostly on computer systems, including a 2021 ransomware attack on Swedish chain Coop that forced it to close most of its roughly 800 stores temporarily.

The attacks show how internet-connected equipment can disrupt food storage, a risk that retailers and regulators are now reviewing.