Supermarket fridges hit with cyberattacks across Europe — here’s why

European supermarkets have become the center of another cyberattack, with hackers remotely heating fridges and spoiling food.

The attack caused temperatures in fridges and freezers to rise sharply, with at least one store reporting temperatures of up to 50°C (122°F) and other retailers discarding food. It’s sparked concerns across the retail industry.

Dutch supermarket group Ahold Delhaize reportedly had dozens of Delhaize stores affected in Belgium and Luxembourg.

The Dutch supermarket giant told CNBC that there was an incident with refrigeration systems in dozens of its stores on Monday, which has resulted in food having to be discarded. It said the situation has since returned to normal with stores fully operational.

Meanwhile, Colruyt Group said five of its Spar stores in Belgium were targeted, according to Reuters. French supermarket Carrefour told the BBC that 15 of its Belgian-based stores were attacked too. France’s Intermarché also said 15 stores out of 153 in total were impacted in Belgium.

“In most cases, the security measures in place made it possible to quickly contain the attack,” an Intermarché spokesperson told CNBC. “However, a few stores did suffer some stock losses, although nothing comparable to the attack in mid-October.

“At this stage, the information available to us indicates that the bulk of the attack affected other players in the sector, notably Carrefour and Delhaize,” they added.

IKEA told CNBC that a cyber incident affected refrigerators and freezers at its Mons store in Belgium between Sunday and Monday.

Although the store is still open to customers, the company is inspecting the affected equipment and products as well as checking installations across its other stores in Belgium.

“The incident has a limited impact on the offering in our restaurant and Swedish Food Market,” an IKEA spokesperson said over email. “We are continuing our investigation to determine exactly what happened.”

ICA, Sweden’s biggest grocery retailer, also confirmed that it had been informed of an incident at a “limited number of stores,” which were on networks outside ICA’s central systems. “The incident has affected the stores’ refrigeration and freezer systems. ICA is currently supporting the affected stores in managing the incident,” the company said over email.

Elsewhere, Finnish Kesko supermarket, Irish grocery chain Supervalu and Estonian grocer One Selver also reported disruptions to their refrigeration systems.

Carrefour did not immediately respond to CNBC’s request for comment.

Hundreds of French supermarkets were targeted in October in a cyberattack that caused fires, fridges to overheat and food to spoil.

Intermarché owner Les Mousquetaires told CNBC at the time that it was expecting damages of several million euros.

“Food security requires more attention at all levels because the weaponization of food has become a reality,” European Commissioner for Agriculture and Food Christophe Hansen said on X in October.

Commissaries at six U.S. military bases also suffered freezer malfunctions in late August.

The Pentagon is now treating those as a suspected hack and coordinating with French authorities, four people familiar with the matter told Reuters in October.

In one case, the refrigerator’s temperature was raised overnight, leaving masses of food melted and wilted by morning.

Sophos Counter Threats Unit’s Senior Director of Threat Intelligence Rafe Pilling told CNBC that while there’s no evidence AI has played a role in these attacks, elsewhere criminals have been using AI to speed up the scale and efficiency of attacks.

The attacks have yet to be claimed by any group or bad actor, and investigations are still underway, but it’s raised concerns about the vulnerability of critical infrastructure.

Fredrik Blix, strategic cybersecurity advisor for Visente AB, said that the hack itself isn’t sophisticated, as the control units for the refrigerators “sit directly on the public internet,” with built-in support logins where the password can be obtained on the same day, according to information from researchers published in August.

“The vendor patched it in August,” Blix said in a LinkedIn post. “Thousands of units never got the update, and the oldest models can’t be updated at all.”

He added that France was hit by the same attack three weeks ago, with France’s CERT-FR telling Europe’s operators to pull the devices off the internet. “The question I put to the suppliers and service companies who install and remotely manage this kit: what exactly did you do with those three weeks?”

Blix noted that the silence behind the attack is the most “interesting clue” as it rules out ransomware crews, leaving two options. Someone either carried out the attack simply because they can, or because someone wants to create “unease in Ukraine-supporting countries without leaving fingerprints,” Blix said.