Suspected attacks heated supermarket freezers to 50C across at least 10 countries

At one Swedish supermarket, someone remotely set the refrigerators and freezers to 50C, or 122F, overnight. Food storage temperatures had become oven temperatures, and the store in Sjöbo had to close before reopening.

Suspected cyberattacks have now disrupted supermarket cooling systems in at least 10 European countries, including Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia, Finland, Italy, Portugal and Germany. Retailers have discarded food after refrigeration units warmed up, in some cases because their evaporators were switched into defrost mode.

The damage: About 40 Delhaize supermarkets in Belgium and Luxembourg were affected. A Delhaize store in Hoeilaart, Belgium, estimated it lost more than €100,000 worth of produce, before counting the additional cost of closing the shop. Carrefour said 15 of its more than 700 Belgian stores were affected, while Colruyt Group said five Spar franchise shops were hit.

In Ireland, SuperValu removed chilled and frozen products from sale at 13 of its 223 stores after a cyber incident affected one specific refrigeration model. In the Netherlands, at least 17 companies, mainly small local shops and butchers, were reportedly affected. Ikea's Mons store in Belgium also had problems with refrigeration and freezer units, though it remained open.

Why it matters: Commercial cooling systems are often connected to the internet so technicians can monitor them, carry out maintenance and troubleshoot remotely. That convenience turns ugly quickly when an outsider gets control of a temperature setting. Sweden's National Cybersecurity Centre said it had identified many exposed operational-technology devices that needed updates or patches.

The attacks came three weeks after a similar incident in France affected up to 700 supermarkets, causing food losses estimated in the tens of millions of euros and fires at some stores. Belgian prosecutors have opened an investigation, and European authorities are examining the broader incidents. No person or group has claimed responsibility, and authorities have not publicly identified a culprit.

The larger problem: This is not a breach where a company changes passwords and carries on. A hacked controller can spoil stock overnight, close a shop and leave staff staring at pallets of food that cannot be sold. The EU's food and agriculture commissioner, Christophe Hansen, called the repeated attacks a deliberate effort to disrupt the food supply chain and undermine consumer confidence.

The thing to watch is whether investigators can connect this wave to the French attack, or establish who has been reaching into Europe’s refrigerated shelves through the internet.