Supermarket fridge cyberattack spikes temperatures in Sweden, Ireland and beyond

The latest wave of suspected cyberattacks has forced refrigeration units in supermarkets across Europe to overheat, with Sweden and Ireland among the hardest‑hit nations. Operators of ICA and Coop in Sweden reported that freezers and fridges rose sharply overnight, while Ireland’s SuperValu confirmed a “cyber incident” affecting 13 of its 223 outlets. The incidents follow a similar breach in France earlier this year that left fridges at 50 °C and sparked fires, highlighting the growing vulnerability of store cooling systems to digital intrusion.

John Billow, head of Sweden’s national cybersecurity centre, told Reuters the agency is responding to “multiple incidents affecting store cooling systems.” He warned that “we have quite a lot of exposed operational technology devices in Sweden that we have been clear about the necessity to update or patch.” The statement shows a broader concern that many refrigeration units, once largely mechanical, now rely on networked controls that can be accessed remotely if not properly secured.

In Sweden, ICA and Coop confirmed that the temperature of freezers at several stores surged suddenly. A spokesperson for privately held ICA said to Reuters via email, “We are aware that a limited number of stores were affected by an incident overnight, which impacted their refrigeration and freezer systems.” Coop added that six of its stores had been affected, according to a report in Aftonbladet. Meanwhile, Axfood disclosed that a distribution centre serving Gothenburg’s home‑delivery grocery service was also hacked, suggesting that the breach may extend beyond retail floors to logistical hubs.

Ireland’s third‑largest chain, SuperValu, reported that a specific model of refrigeration system was compromised at 13 of its stores. The company described the event as a “cyber incident” but gave no further detail on the method of intrusion. SuperValu’s response aligns with statements from other retailers that the affected units were set to defrost mode, a configuration that can cause rapid temperature rise if left unchecked.

Belgium and Luxembourg saw similar patterns, with the Belga news agency linking overnight temperature hikes at dozens of Ahold Delhaize stores to a cyberattack. Stephan Moelans, chief executive of refrigeration firm Sabcobel, told reporters that the units’ evaporators were switched to defrost mode, effectively disabling the cooling cycle. A spokesperson for Colruyt Group added that five Spar shops in Belgium experienced the same issue, confirming that the problem was not isolated to a single brand or country.

Estonia’s involvement was confirmed by technology supplier Kitman Coldtech, which told public broadcaster ERR that at least one supermarket chain there was affected. Kitman’s chief executive Jann Mutso said, “This is very fresh, it happened this morning,” and noted that the temperatures at the Estonian chain were also set to 50 °C (122 °F). While the chain’s name was not disclosed, the swift acknowledgment suggests that the breach was detected quickly and that remediation steps are already underway.

The French incident that preceded these events remains a cautionary benchmark. Hundreds of supermarkets there suffered temperature spikes that reached 50 °C, leading to spoiled food and, in some locations, fires that caused millions of euros in losses. Dutch police were notified of a cybersecurity incident by Ahold Delhaize last month, indicating that law‑enforcement agencies are now part of the response framework for such attacks.

Industry experts warn that the reliance on networked operational technology in retail refrigeration creates a new attack surface for cybercriminals. Operational technology, or OT, refers to the hardware and software that control physical processes such as temperature regulation. When these systems are connected to corporate networks, or even the internet, malicious actors can exploit unpatched software, default passwords, or insecure remote‑access tools to manipulate the equipment.

Although no group has claimed responsibility for the latest incidents, the pattern of coordinated temperature manipulation points to a sophisticated approach that bypasses traditional perimeter defenses. Retailers are urged to accelerate patching cycles, isolate critical control systems from public networks, and conduct thorough risk assessments of their supply‑chain hardware. The Swedish cybersecurity centre’s comment about exposed devices show the need for a systematic upgrade of legacy refrigeration units that were never designed with cyber threats in mind.

As authorities continue to investigate, the affected supermarkets are working to restore safe temperatures and assess any product loss. In Sweden, a store posted on social media that its refrigerators and freezers had been set to the same temperature as during the French cyberattack, prompting immediate checks by store managers. In Ireland, SuperValu has advised customers to check purchase receipts and report any spoiled goods, a standard precaution aimed at managing potential consumer claims.

The impact on everyday shoppers extends beyond inconvenience. Perishable items such as dairy, meat and fresh produce can become unsafe within hours of a temperature rise, leading to waste and financial loss for both retailers and consumers. Moreover, the disruption can erode confidence in the safety of food supply chains, especially when news of cyber‑induced spoilage spreads quickly on social media.

Retail associations across Europe are expected to convene in the coming weeks to share best practices and coordinate a unified response, aiming to prevent further disruptions and protect the integrity of food supplies. Such meetings typically bring together cybersecurity specialists, equipment manufacturers, and supermarket executives to discuss hardening strategies, incident‑response protocols, and possible regulatory measures.

In the meantime, the immediate priority for the supermarkets involved is to bring refrigeration units back to normal operating temperatures, replace any compromised hardware, and verify that no residual malware remains in the control systems. The coordinated effort between corporate IT teams, national cybersecurity agencies and, where appropriate, law‑enforcement bodies reflects a growing recognition that cyber threats to physical infrastructure are no longer theoretical.

The next steps will likely include detailed forensic analysis of the attacked devices, public reporting of any identified vulnerabilities, and the rollout of security updates across affected brands. As more information emerges, retailers will have to balance rapid remediation with the need to keep shelves stocked and customers informed, a challenge that show how intertwined digital security has become with the everyday experience of buying groceries.