Cyber-Attack Disables Supermarket Freezers Across Seven European Nations

A coordinated cyber-attack has knocked out refrigeration systems at dozens of supermarkets across seven European countries, spoiling perishable inventory and exposing critical vulnerabilities in internet-connected industrial cooling equipment. Belgian manufacturer Sabcobel confirmed the attack replicated methods used against French retailers last month.

Key Takeaways

Coordinated cyber-attack hit supermarket refrigeration in 7 European countries (Belgium, Luxembourg, Sweden, Ireland, Netherlands, Estonia, Finland), replicating October French attack method.
Attack vector: Remote access to Sabcobel-manufactured evaporators switched units to defrost mode, raising temps to 50°C; physical hardware mods required, not just software patches.
~40 Delhaize stores, 15 Carrefour Belgium, 5 Colruyt/Spar, 7 Coop Sweden (of 800), several ICA, and 1 Ikea store confirmed affected; single Delhaize branch lost €100k in produce.
Belgian, Swedish, UK, and US cyber agencies investigating; US probing links to August military base refrigeration failures — suggesting possible broader OT campaign.
Sector-wide OT security reassessment underway: network segmentation, air-gapped controls, and manual overrides now critical for cold chain resilience.

INTELLIGENCE

Executive Intelligence Brief

What Happened: A cyber-attack disabled refrigeration systems at dozens of supermarkets across seven European countries, forcing the disposal of millions of euros worth of perishable goods. The attack exploited a vulnerability in internet-connected cooling units manufactured by Sabcobel, replicating a method used against French retailers in October.

Why It Matters: The incident exposes systemic operational technology (OT) vulnerabilities in critical food supply chain infrastructure, demonstrating how remote maintenance access vectors can be weaponized to cause immediate physical spoilage and financial loss across multiple jurisdictions simultaneously.

What to Watch: Belgian and Swedish cyber-security agencies are investigating attribution; Sabcobel is implementing physical hardware modifications to secure units; UK NCSC is coordinating with international partners to assess domestic exposure; US authorities continue probing potential links to military base refrigeration failures in August.

Attack Mechanism and Geographic Scope

The attack targeted evaporator units manufactured by Sabcobel, a Belgian firm that operates and maintains refrigeration systems for major retailers. Attackers remotely accessed the units and switched them into defrost mode, causing internal temperatures to rise as high as 50°C (122°F). The incident affected approximately 40 Delhaize stores in Belgium and Luxembourg, 15 Carrefour locations in Belgium, five Colruyt Group-operated Spar stores, and an Ikea store in Mons. In Sweden, a "small number" of ICA stores operating outside the central network and seven of Coop's 800 outlets were hit. Smaller numbers of shops were also affected in Ireland, the Netherlands, Estonia, and Finland.

Precedent: The French Connection

The method mirrors an early October attack that disabled refrigeration at hundreds of French supermarkets, resulting in millions of euros in food waste. Sabcobel CEO Stephan Moelans told the Belga news agency the company had been "working all night and morning to disconnect the affected units from the network." He acknowledged that despite efforts to "protect our customers' fridges against this vulnerability" since the French incident, the remediation requires physical hardware modifications rather than software patches alone. "The simplest solution is to manage the fridges over a secure internet connection. Most of our customers switched to that after the attack in France," Moelans added.

Financial Impact and Operational Fallout

A single Delhaize branch in Hoeilaart, Flanders, reported €100,000 (£83,500) in lost produce, excluding revenue losses from store closure. Carrefour stated measures were taken immediately to keep all shops open. ICA and Coop Sweden confirmed the situation is contained, though Ikea warned additional locations may be affected. The attacks highlight the fragility of just-in-time cold chains where remote management interfaces — designed for maintenance efficiency — create a single point of failure across geographically dispersed assets.

Investigations and Cross-Border Coordination

Belgium's Centre for Cyber Security (CCB) and Sweden's Civil Contingencies Agency (MSB) are monitoring the incident. The UK's National Cyber Security Centre (NCSC) said it is working with international partners to "fully understand details of an incident," though no UK impact has been reported. Notably, US authorities are investigating refrigeration malfunctions at American military bases in August and coordinating with French officials to examine potential links, suggesting a possible broader campaign targeting operational technology in the food and defense sectors.

Remediation Timeline and Sector Implications

Sabcobel has not disclosed a completion timeline for the required physical modifications. The incident forces a sector-wide reassessment of OT security architectures: network segmentation, air-gapped backup controls, and manual override capabilities for critical cooling infrastructure. For insurers and risk managers, the event establishes a precedent for cyber-induced physical spoilage losses across multi-national retail portfolios.