Employees empty freezers to load shopping carts with frozen goods that have to be thrown away at ICA Kvantum supermarket in Sjoebo, Sweden on November 2, 2026 after a hacker attack raised the temperature in the freezers to 50 degrees Celcius. A handful of Swedish supermarkets saw temperatures in their refrigerators and freezers soar early on November 2, 2026, two chains said, forcing them to throw away spoiled food three weeks after a similar incident in France attributed to hackers. The Swedish chains Ica and Coop told AFP they had no information that their refrigeration systems had been the victims of a cyberattack.
Photo by Johan NILSSON / TT NEWS AGENCY / AFP via Getty Images / Sweden OUT
The BriefingThe European Commission held two emergency meetings Tuesday with ENISA, Europol and the CyCLONe network after refrigeration cyberattacks struck more than 100 stores across at least 11 European countries over the weekend.Hackers exploited internet-connected Danfoss and Copeland control units — pushing temperatures to 50°C — at major chains including Delhaize, Carrefour Belgium, SuperValu and ICA, forcing the disposal of large quantities of spoiled food.No group has claimed responsibility; private security analysts suggest state-sponsored origins with high confidence, while Romania’s cyber chief described the methods as “semi-amateurish.”A Second Wave Strikes Eleven CountriesThe European Commission convened two urgent coordination sessions on Tuesday after a sweeping round of cyberattacks on supermarket refrigeration systems spread across at least 11 European countries, following an initial assault that began overnight between Sunday and Monday. The first meeting brought together the EU Agency for Cybersecurity (ENISA), Europol and relevant Commission departments. The second took place within the CyCLONe network, the bloc’s dedicated framework for coordinating cyber crisis response among member states, with representatives from directly affected countries present.How the Attacks Were Carried OutThe method was precise and consistent across borders. Attackers gained remote access to internet-connected refrigeration controllers and either forced internal temperatures to roughly 50°C or locked freezer units into continuous defrost cycles — in both cases rendering the contents unsalvageable within hours. At an ICA Kvantum outlet in Sjöbo, southern Sweden, staff arrived to find units running at that temperature and hauled cartloads of spoiled product to dumpsters. In Germany’s Kaiserslautern district, refrigeration systems at a food-processing facility and a nearby supermarket registered readings between 30 and 50 degrees before authorities were alerted.
Which Chains and Countries Were HitThe initial wave, confirmed by Euronews, struck Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia. By Tuesday, additional incidents had been reported from Germany, Italy, Portugal and Romania, bringing the confirmed total to at least 11 countries.Among the major retailers affected: roughly 40 Delhaize locations across Belgium and Luxembourg; 15 Carrefour Belgium stores; 15 Intermarché shops; five Spar outlet locations; and 13 SuperValu stores in Ireland, whose parent group Musgrave confirmed the losses of chilled and frozen product. In Sweden, both ICA and Coop reported overnight disruptions, while IKEA confirmed that refrigeration at its Mons, Belgium, outlet had been compromised as well. In the Netherlands, Danfoss told NOS that at least 17 businesses — primarily butcher shops and small neighborhood grocers — were struck.A Known Vulnerability, Left UnpatchedSecurity researchers traced a significant share of the incidents to Danfoss AK-SM and AK-SC refrigeration controllers, as well as Copeland and Dixell xweb units — the same hardware implicated in a parallel assault on approximately 700 French supermarkets the previous month. Researchers at Claroty had identified the vulnerabilities in 2025 and followed a coordinated disclosure process that allowed patches to be issued before public notification in August 2026. Despite that head start, a substantial portion of retail operators had never updated their systems — leaving thousands of network-reachable controllers exposed to anyone who knew where to look. SecurityWeek reported that, as of late October, 138 exposed instances remained active in Belgium alone.Brussels Puts Europe on NoticeEU Agriculture Commissioner Christophe Hansen framed the attacks in explicit terms, calling them a deliberate effort to disrupt Europe’s food supply and erode consumer confidence — while clarifying that the bloc’s overall food security was not currently at risk. He added that the Security College of the European Commission, the body responsible for strategic threat assessment, would take up the matter at an upcoming session. An EU spokesperson told reporters in Brussels that the incidents were not isolated, signaling that officials see a coordinated pattern rather than a string of unrelated breakdowns.Italy’s Prime Minister Giorgia Meloni convened an emergency session with intelligence chiefs, though Italian officials noted the domestic impact remained “currently very limited,” with roughly 20 stores affected nationwide. Germany’s federal prosecutors opened a formal investigation.
State Sponsorship Suspected, Proof ElusiveWhile no government has named a suspect publicly, private cybersecurity firms monitoring the attacks have been less guarded. Analysts described the campaign as bearing the hallmarks of prior operations linked to the Kremlin, citing overlapping IP infrastructure seen in Russian-attributed sabotage campaigns. At least one firm placed its confidence in state-sponsored origins at 95 percent. The absence of malware — attackers appear to have exploited legitimate remote access credentials rather than deploying malicious code — has complicated formal attribution. Romania’s national cyber director noted the approach pointedly, describing the methods as “semi-amateurish” despite the tangible damage caused on the ground.What Europe Plans to Do NextThe European Commission announced plans to evaluate the cyber resilience of European retail chains, with particular focus on the security of internet-connected operational technology across cold chain infrastructure. No binding remediation steps have been issued, but mounting political pressure from member states and retail industry groups is expected to accelerate action. For consumers across the continent, the incidents delivered an unambiguous reminder: the digital systems that govern whether food on a supermarket shelf stays safe to eat are, in many cases, still running on hardware from another era — and the door has been left open.© {{Year}} Latin Times. All rights reserved. Do not reproduce without permission.
Click Here For The Original Source.
——————————————————–
