Refrigeration systems at supermarkets across seven European countries froze solid overnight Monday, spoiling inventory, after a similar attack in France last month targeted U.S. military bases.
On Monday, supermarket chains in at least seven European countries reported refrigeration failures. In some shop refrigerators and freezers, temperatures reached 50C (122F) overnight. The affected countries were Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden.
The U.S. Army said on Monday that its cyber investigators were examining the issue. The Pentagon acknowledged "speculation regarding a potential cyber incident", and its inspector general's office was also investigating.
Pattern of escalation
Officials said a cyberattack last month disrupted freezers at hundreds of grocery stores in France. The October 12 hack involved some 500–700 supermarkets and raised temperatures to as high as 50 degrees Celsius.
Five major groups in France’s retail sector were affected: E.Leclerc, Intermarché, Carrefour, Monoprix and Coopérative U. At least 300 Intermarché and Netto stores and more than 100 Coopérative U stores were affected. Carrefour reported 80 affected stores, while about five per cent of Monoprix’s roughly 490 stores were targeted.
The French attack sparked fires and led to food losses valued at tens of millions of euros. At individual supermarkets in France, reports put losses at tens of thousands of euros in some cases and above €130,000 (£109,000) in others.
French authorities believe the October 12 hack may have involved international actors, but no official blame has been made.
- Belgium Delhaize said an "IT incident" had affected refrigeration in several dozen stores, mostly in Belgium and a few in neighbouring Luxembourg. Carrefour said a cyberattack targeting refrigeration had affected 15 of its more than 700 Belgian stores, and described the impact as "extremely limited."
- Ireland Musgrave Group said refrigeration systems in 13 SuperValu stores were affected by the "cyber incident," and chilled and frozen products were removed from sale as a precaution.
- Other countries Retailers in Estonia, Finland, Luxembourg, the Netherlands and Sweden also reported problems with their refrigeration systems on Monday.
Why refrigeration became a target
The big problem I see is that shops didn't consider themself as possible targets. I think there's an urgent need to start protecting those services that didn't consider them important enough.
They run on old systems that are deprioritised or impossible to patch; many of the controllers hit in France, for example, were older models that no longer receive security updates, despite flaws known since 2025.
Retail chains are vulnerable because they operate vast numbers of connected systems, including refrigeration controls, facilities systems, entry-access equipment and checkout terminals, said Tom Hegel and Patrick Lamplmair, from cybersecurity firms SentinelOne and Tributech. Even after the French attack, thousands of these controllers remained accessible online.
Hackers took control of controllers in the French incident, many supplied by Danish company Danfoss. The company said it had found some security flaws in 2025 and had "long recommended" that customers install updates.
Why defenders cannot keep pace
AI-driven vulnerability detection makes finding and exploiting weak points easier and faster than ever, including in vital functions on which people depend — while patching at this speed remains a bottleneck for defenders.
The attackers seemed to activate a forced-defrost setting, causing units to heat rather than cool, BFM, a French TV channel, said. The French shops were shut when the attackers struck, leaving temperatures to climb for hours before anyone could notice. Monday's incidents in Sweden also happened overnight.
A handful of temperature-controller commands could ruin stock overnight and force stores to close, Lamplmair said.
Questions of motive
Investigators are silent about current results of the investigation in France, but by elimination it is likely that we have some state-supported group behind this.
The supermarket attacks, which involved no financial demands, pointed to sabotage, said Tom Hegel of the cybersecurity firm SentinelOne. Lamplmair of the cybersecurity firm Tributech said attackers would continue "until it stops working" because the method was "cheap and the damage is immediate".
The repeated cyber-attacks were deeply concerning, said Christophe Hansen, the EU food and agriculture commissioner, describing them as "a deliberate attempt to disrupt our food supply chain and undermine consumers' confidence in it".
Military incidents under investigation
On August 26, the contents of freezers at a market on the Army base in Fort Huachuca, Arizona, were spoiled after the units unexpectedly switched to defrost mode. Naval Station Newport in Newport, R.I., reported "refrigeration system issues at the commissary" that same day.
Army officials are investigating whether August malfunctions at U.S. military facilities were connected to a broader cyberattack.
Broader vulnerability landscape
Sweden's national cybersecurity centre was handling incidents nationwide and had found "quite a lot of exposed operational technology devices" that needed updating or patching, said its head, John Billow.
It will probably get worse before it gets better.
The Pentagon's inspector general is investigating whether August incidents at Fort Huachuca and Naval Station Newport were part of a wider cyberattack; results may clarify whether Monday's European incidents are linked.
