HIGHLIGHTS:
Cyber-attacks on supermarket refrigeration systems hit at least 10 European countries, with freezer temperatures reportedly soaring to 50°C.
The EU calls it a “deliberate attempt to disrupt our food supply chain,” though Romania’s cyber chief dismisses the culprits as “semi-amateurish.”
Belgium was among the hardest hit, with federal prosecutors opening an investigation into dozens of affected stores.
The attacks follow a similar incident in France three weeks ago that disrupted up to 700 grocery stores.
Security experts point to outdated software and internet-exposed refrigeration controls as the key vulnerability.
I spent Tuesday morning scrolling through reports from across Europe, and the picture that emerged was as absurd as it was alarming. Somewhere out there, someone was turning supermarket freezers into weapons not with ransomware notes or stolen data, but simply by cranking the temperature up until the food rotted.
The attacks hit at least ten countries: Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Germany, and Sweden, with the UK also affected. In some cases, freezer temperatures reportedly climbed to 50°C (122°F). Retailers were forced to discard entire inventories. At a Delhaize store in Belgium, manager Mathieu Tilman voiced what many must have felt: “I don’t even understand how anyone could do this… How can we end up throwing away so much food?”
The European Union wasn’t mincing words. Food and agriculture commissioner Christophe Hansen called it “a deliberate attempt to disrupt our food supply chain”. Spokesman Thomas Regnier stressed these were “not isolated incidents” and urged collective resilience. Italy convened emergency intelligence talks, though it downplayed the impact, noting affected stores mostly ran “obsolete security systems”. Belgium, however, opened a federal investigation.
What struck me most was the technical vulnerability at the heart of it all. Refrigeration systems are often connected to the internet so contractors can monitor them remotely. Security firm Forescout found nearly 13,000 refrigeration control services openly reachable online across 99 countries. In Sweden, Coop’s affected stores were running on old 4G networks rather than updated 5G systems. Danfoss, the Danish supplier whose software was implicated, said customers who hadn’t updated were the ones hit.
Not everyone is convinced this is a state-level operation. Romania’s cybersecurity chief, Dan Cimpean, whose country saw six stores affected, called it “semi-amateurish” and said: “We do not suspect, under any circumstances, that it is a state actor”.
I don’t know who’s behind this, and frankly, neither does anyone I’ve read. But I do know this: when the food supply chain can be sabotaged by exploiting a forgotten freezer login, we have a problem far bigger than spoiled groceries.
