A coordinated wave of cyberattack incidents disrupted refrigeration across European supermarket chains, triggering spoiled food and temporary outages in countries including Sweden, Belgium, Luxembourg, Estonia, and earlier in France.

In Sweden, ICA Group reported freezer and refrigeration issues at a limited number of stores, with at least one Sjobo branch having freezers set to extreme temperatures and items being discarded; Coop Sweden also flagged six stores facing cooling problems.

Hackers allegedly raised temperatures in refrigeration units by as much as 50°C, using a method linked to a previous October incident that affected hundreds of French supermarkets.

Industry commentary notes improving secure internet management, but emphasizes the ongoing need for physical protections and secure configurations to mitigate such intrusions.

Authorities cited internet-facing equipment, weak passwords, and poor protection of remote access as immediate risks, underscoring the necessity for clear responsibility and robust access controls.

Attribution remains unclear, with potential perpetrators ranging from opportunists to more capable groups, and investigations expected to extend beyond the incidents themselves.

Responses show coordinated damage control, including emergency maintenance and isolating affected equipment to limit impact.

Security expert notes the attacks align with extortion, sabotage, or state-linked activities, with the lack of ransom signals suggesting sabotage rather than financial demands.

Regulatory and insurance factors add complexity: EU Cyber Resilience Act introduces reporting and security requirements, but many older devices won’t be upgraded automatically, and cyber insurance may exclude stock losses without extra coverage.

Experts warn these events reveal the vulnerability of food supply chains to cyber threats and the need for stronger security in industrial control systems.

Authorities and companies report that distribution centers largely continued normal operations, deliveries were largely unaffected, and rapid response contained incidents with limited visible damage.

Attackers are leveraging widely available intrusion tools and AI-assisted vulnerability discovery, signaling growing capability and automation in these operations.