Who’s behind the wave of refrigerator hacks that hit Europe over the weekend?

A wave of cyberattacks has struck supermarket refrigeration systems across Europe, causing freezer temperatures to rise to 50°C and forcing retailers to discard spoiled food.

The incidents unfolded overnight from Sunday to Monday, with some store operators discovering the damage only hours after the attacks began.

Supermarkets in Belgium, Estonia, Ireland, Luxembourg, the Netherlands, Denmark, Sweden, and Finland were forced to throw away tons of spoiled food.

Business owners notified in the middle of the night

In Ireland, SuperValu removed chilled and frozen products from 13 stores after refrigeration systems were affected by a suspected cyberattack.

The damage was particularly severe at a Belgian store belonging to the De Laet & Van Haver butchery chain. Its owner, Luc De Laet, found that refrigerator temperatures had climbed as high as 18°C.

The incident destroyed approximately €15,000 worth of meat.

It's very scary

De Laet told Reuters.

In Sweden, several grocery stores reported refrigeration problems. ICA confirmed that a limited number of its stores had been affected by an overnight incident involving refrigeration and freezer systems.

One ICA franchise store in Stockholm discovered that its refrigerators and freezers had been set to 50°C.

Sales manager Engla Ingwall told Reuters that the attack happened at approximately 2 a.m., but employees did not notice the problem until hours later.

Everything is destroyed

Ingwall said.

Grocery group Coop also reported that six of its stores had experienced similar problems.

“We've been working all night”

Stephan Moelans, CEO of Belgian refrigeration company Sabcobel, which operates Dutch food giant Ahold Delhaize's systems, confirmed the incident to Belgium's national news agency Belga.

According to him, the incident was a cyberattack in which the units’ evaporators were switched to defrost mode.

"We began mobilizing technicians at 1 am to get the situation under control," Moelans said. "Personally, I've been awake since 2 am. We've been working all night and morning to disconnect the affected units from the network."

A spokesperson for Colruyt Group, which operates Spar stores in Belgium under a franchise system, told the Independent that five shops had their fridge systems attacked.

In the Netherlands, at least 17 companies have been affected.

Temperatures rose above 50°C

In Estonia, hackers accessed a computer controlling refrigeration equipment at a Selver supermarket and changed a freezer's temperature to 50°C, according to public broadcaster ERR.

Jann Mutso, head of refrigeration technology manufacturer and distributor Kitman Coldtech, confirmed to the broadcaster that one of its clients had been attacked, adding that other businesses in the country had also been affected.

Mariann Järvela, communications chief for Selver, one of the biggest chains in Estonia, confirmed that the incident had affected one of the chain's stores but declined to disclose its location or technical details.

Finnish authorities have also confirmed several suspected intrusions. The National Cyber Security Center received reports of successful attacks, although the damage was limited, specialist Juha Tretjakov told Finnish newspaper Ilta-Sanomat.

According to Helsinki Times, retailer Kesko reported temperature disturbances at several smaller K-market stores whose refrigeration systems operated outside its central security network.

Who’s responsible?

The latest wave of attacks follows a series of attacks in France last month, when hackers took control of refrigeration controllers at hundreds of supermarkets.

The affected controllers were manufactured by Danish company Danfoss, which eventually issued software updates.

However, the risk of similar attacks remains high. Forescout identified nearly 13,000 vulnerable refrigeration services across 99 countries.

No group has claimed responsibility for the attacks. However, the incidents have raised concerns about growing hybrid threats to critical infrastructure amid heightened security tensions following Russia's 2022 invasion of Ukraine.

Russia-linked hacktivist groups Z-Pentest Alliance and NoName057(16) have been actively targeting refrigeration systems since January 2026. According to Forescout researchers, more than 20 attacks were claimed this year.The reported targets included fruit storage facilities, wineries, supermarkets and other agricultural and food-processing businesses.

Forescout also found that 80% of observed Danfoss AK-SM 800A StoreView services were running outdated firmware affected by known vulnerabilities.