Someone Is Setting Europe's Freezers to 50C. Now the Commission Is Investigating

Overnight on Monday, refrigerators and freezers in supermarkets across at least seven European countries began climbing towards 50C. In Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden, chains found their cold chain sabotaged remotely. Several confirmed they had been hacked.

The EU's food and agriculture commissioner, Christophe Hansen, called the attacks "a deliberate attempt to disrupt our food supply chain and undermine consumers' confidence in it." The Commission is now investigating.

What happened in the stores

Sweden's Coop said six of its shops were hit. ICA said a limited number of stores were affected, and one branch in Sjöbo posted that its fridges and freezers had been hacked and set to 50C. Another store in Stockholm told customers its freezers had broken "due to a 2am cyberattack" and that "everything was destroyed." John Billow, head of Sweden's national cybersecurity centre, said the country had "quite a lot of exposed operational technology devices" that needed updating or patching.

Ahold Delhaize reported that fridges and freezers in dozens of its supermarkets in Belgium and Luxembourg had been affected. Reporters visiting a store north-east of Brussels found empty shelves and a handwritten sign: "Due to cyberattacks, there will be no products on the refrigerated or freezer shelves."

Belgium's Le Soir reported dozens of shops affected, including five Spar outlets, Shop & Go convenience stores attached to Q8 service stations and smaller Proxy Delhaize mini-markets. Stephan Moelans, chief executive of Sabcobel, which runs Delhaize's refrigeration, said: "We started mobilising technicians at 1am. We spent all night and morning disconnecting the affected installations." The units' evaporators had been switched into defrost mode.

Colruyt reported problems in five shops, Intermarché in fifteen, Carrefour Belgium in about fifteen of its 700. Ikea's store in Mons lost freezer stock. Finland's Kesko investigated similar faults, Dutch radio NOS counted at least seventeen mainly small local shops, and Ireland's SuperValu said 13 of its 223 stores were affected through one specific model of refrigeration unit.

In Estonia, the refrigeration supplier Kitman Coldtech told ERR that attackers had reached a computer controlling a store's cooling system and turned the temperature to 50C. Its chief executive, Jann Mutso, said the response came within minutes and damage was limited. The Selver chain confirmed one outlet affected.

This is the second wave

Three weeks ago, hackers seized control of cooling units in as many as 700 French supermarkets, including Intermarché, Coopérative U, Carrefour, Leclerc and Monoprix, pushing temperatures from as low as -27C to well over 50C. Fires broke out. Fresh meat, dairy and frozen goods were discarded. Individual stores reported losses from tens of thousands of euros to more than €130,000, with national damage estimated in the tens of millions.

The Paris prosecutor's office opened a formal investigation, and Prime Minister Sébastien Lecornu instructed the national cybersecurity agency ANSSI to look into it. Most of the pirated controllers in that attack were supplied by the Danish manufacturer Danfoss, which said it had identified security flaws the previous year and had "long recommended" customers install updates.

Sabotage, not extortion

What makes this campaign unusual is the silence. There have been no ransom notes, no extortion demands and no claims of responsibility. "Retail is an easy target because retail chains run enormous estates of refrigeration controllers, building management systems, door access panels and point-of-sale gear," Tom Hegel of SentinelOne told Reuters. With no financial motive visible, the pattern points to sabotage.

Patrick Lamplmair of the cybersecurity firm Tributech described the economics bluntly: attackers will keep going "until it stops working" because the method is "cheap and the damage is immediate." His most damning observation is that "thousands of these controllers were still reachable from the internet after the French attack."

A few commands to a temperature controller can destroy a store's stock overnight and close it for a day. That is a very high ratio of damage to effort, and it requires no malware development, no phishing campaign and no insider.

Why Brussels is treating it as strategic

Since Russia's full-scale invasion of Ukraine, European authorities have warned repeatedly that the fastest route into a Member State is through its connected civilian systems rather than its military ones. Building management, heating and ventilation, and cold chain logistics are all industrial control systems with remote access, often installed by contractors and never audited again.

The NIS2 directive was written for exactly this. It brings food retail and critical supply chains into scope, requires patch management and incident reporting, and gives regulators the power to audit. What this week shows is the gap between a directive on paper and a continent of unpatched controllers on the public internet.

Nobody died. That is not the point. The point is that someone demonstrated, twice, that they can reach into European shops and destroy inventory at will, and that Europe's response so far has been technicians with screwdrivers at one in the morning.