.png "Global Insight")
In the early hours of Monday morning, supermarket freezers across several European countries started heating up on their own. Staff found chilled cabinets warming instead of cooling, and food that was supposed to stay frozen spoiling by the shelf. Retailers now say it was the second suspected cyberattack of its kind in less than a month — and the method, investigators believe, was almost embarrassingly simple.
The latest wave hit dozens of stores in Belgium and Luxembourg, with smaller numbers affected in Sweden, Ireland, Estonia and the Netherlands. Dutch retail giant Ahold Delhaize confirmed an IT incident had struck fridges and freezers in dozens of its supermarkets in Belgium and Luxembourg, with temperatures in the cooling systems rising. In Sweden, the Coop chain told the newspaper Aftonbladet that six of its stores were affected, while ICA said a limited number of its stores had been hit overnight. Belgian newspaper Le Soir reported dozens of affected outlets, including Spar stores and smaller Proxy Delhaize minimarkets.
What happened overnight
Refrigeration installer Sabcobel said its technicians began mobilising at 1 a.m. to disconnect affected units. Its chief executive, Stephan Moelans, said the company knew of around 20 affected units among the hundreds it manages. The pattern matched the previous attack almost exactly: hackers remotely switched the units into defrost mode, overriding the temperature controls, and in some cases pushed temperatures as high as 50 degrees Celsius. At that temperature, a freezer is not preserving food — it is cooking it.
Once a cabinet warms past safe limits, everything inside has to be thrown away, whether or not it looks spoiled. No group has claimed responsibility for this wave or the previous one, no law-enforcement agency has yet named a perpetrator, and no ransom demand has been reported.
How a freezer gets hacked
A modern supermarket freezer is a computer with a door. Cold aisles are connected to the internet so maintenance teams can monitor temperatures remotely and receive alerts when something fails. That convenience is also the vulnerability: if the controller running the refrigeration can be reached online, and if it is old, unpatched or weakly protected, an attacker who finds it can change its settings just as a technician would.
In the French attack, the hackers reportedly disabled alarm systems before extending the defrost programme by hours, so nobody was warned while temperatures climbed. Security researchers had flagged the risk: Claroty warned in August that the units were at risk of remote hacking, and TechCrunch reports the French units were made by Danish company Danfoss, which was no longer providing security updates for them. Danfoss says it identified flaws last year and recommended updates — but an update never applied is barely better than none.
Why the October attack in France matters
Three weeks earlier, a similar attack hit France on a far larger scale: police said hackers seized cooling units at up to 700 supermarkets, pushing them from as low as minus 27 degrees Celsius to well over 50 degrees. Chains including Intermarché, Carrefour and Leclerc were affected, with individual store losses reaching more than 130,000 euros. The Paris prosecutor opened a formal probe, and France's cybersecurity agency, ANSSI, later confirmed that supermarkets using controllers from two other companies were also targeted — so the problem is not confined to one manufacturer.
A repeat using the same technique across different countries looks like a playbook — and a playbook only works if the weakness is still there. As with the fragile internet infrastructure underpinning modern life, the food chain rests on devices designed to be convenient first and secure second.
What happens next
The immediate response is physical: disconnect units, discard spoiled stock, and check every controller. The longer fix is harder: Sabcobel's chief executive says protecting these systems requires physical modifications, not just software updates. Investigators must now establish whether the same people carried out both waves.
The lesson echoes other recent cyber incidents such as the multi-billion-dollar Binance hack: the most damaging attacks are not always the most sophisticated. Sometimes they find a forgotten device, left online and unpatched, and turn an everyday machine against the people who depend on it. Europe's freezers were supposed to be the quietest part of the food system. Twice in three weeks, someone has made them impossible to ignore.