Hackers remotely overheat fridges at European supermarkets, spoiling food

CNBC reports that hackers remotely drove up the temperature in fridges and freezers at supermarkets and other retailers across Europe, spoiling food. At least one store reported temperatures of up to 50°C (122°F), and other retailers discarded stock. The incident hit on Monday and follows a similar attack on French supermarkets in October.

Dutch group Ahold Delhaize told CNBC that dozens of its Delhaize stores in Belgium and Luxembourg had an incident with refrigeration systems on Monday, and food had to be discarded. It said the situation has since returned to normal and the stores are fully operational. Colruyt Group said five of its Spar stores in Belgium were targeted, according to Reuters. Carrefour told the BBC that 15 of its Belgian stores were attacked too; Carrefour did not immediately respond to CNBC's request for comment. Intermarché said 15 of its 153 stores in Belgium were impacted. An Intermarché spokesperson said that in most cases the security measures made it possible to quickly contain the attack, but a few stores did suffer some stock losses, "although nothing comparable to the attack in mid-October". The spokesperson added that the available information indicates the bulk of the attack hit other players, notably Carrefour and Delhaize.

IKEA said a cyber incident affected refrigerators and freezers at its Mons store in Belgium between Sunday and Monday. The store is still open, and the company is inspecting the affected equipment and products and checking installations at its other Belgian stores. An IKEA spokesperson said the incident has a limited impact on the offering in its restaurant and Swedish Food Market. In Sweden, ICA, the country's biggest grocery retailer, confirmed an incident at a "limited number of stores" that were on networks outside ICA's central systems; it said the incident affected the stores' refrigeration and freezer systems. Finland's Kesko, Ireland's Supervalu and Estonia's One Selver also reported disruptions to their refrigeration systems.

An EU Commission spokesperson told CNBC that the Commission is in direct contact with national authorities to investigate, and convened a meeting of the EU interinstitutional Task Force together with ENISA and Europol.

The October attack hit hundreds of French supermarkets and caused fires, overheated fridges and spoiled food. Intermarché owner Les Mousquetaires told CNBC at the time that it expected damages of several million euros. European Commissioner for Agriculture and Food Christophe Hansen said on X in October that food security requires more attention because "the weaponization of food has become a reality". Separately, commissaries at six U.S. military bases had freezer malfunctions in late August; four people familiar with the matter told Reuters in October that the Pentagon now treats those as a suspected hack and is coordinating with French authorities. In one case the refrigerator's temperature was raised overnight, leaving food melted and wilted by morning.

No group has claimed the attacks, and investigations continue. Rafe Pilling, senior director of threat intelligence at Sophos Counter Threat Unit, said the jury is still out on whether the attackers are cyber criminals or have other intents. He noted that empty fridges are a powerful psychological image that can make a relatively small attack feel like a major societal disruption, and that visibility can matter to attackers as much as financial damage. Fredrik Blix, strategic cybersecurity advisor for Visente AB, said the hack is not sophisticated: the refrigerator control units "sit directly on the public internet", with built-in support logins whose password can be obtained the same day, according to researchers' information published in August. In a LinkedIn post he wrote that the vendor patched it in August, but thousands of units never got the update and the oldest models cannot be updated at all. Blix called the silence behind the attack the most "interesting clue", since it rules out ransomware crews. That leaves two options in his view: someone did it simply because they can, or someone wants to create unease in Ukraine-supporting countries without leaving fingerprints.

CNBC notes there is no evidence AI played a role in these attacks. Pilling said criminals elsewhere are using AI to speed up the scale and efficiency of attacks, and that AI is likely to play a significant role in orchestrating and executing attacks like this in future. Meanwhile the U.K.'s National Cyber Security Centre warned on Tuesday in a new report that critical national infrastructure needs to prepare for ransomware attacks involving AI-powered malware, which will become increasingly likely over the next two years. NCSC CEO Richard Horne said: "For decades, we have collectively got away with doing tech on the cheap."

Key facts

Fridges and freezers at retailers in Belgium, Luxembourg, Sweden, Finland, Ireland and Estonia were hit on Monday; at least one store reported up to 50°C (122°F) and food was discarded.
Ahold Delhaize had dozens of Delhaize stores affected; Colruyt said five of its Spar stores were targeted, Carrefour (per the BBC) 15 Belgian stores, Intermarché 15 of 153 Belgian stores. IKEA's Mons store and ICA stores in Sweden were also hit.
No group has claimed responsibility. Sophos's Rafe Pilling says it is unclear whether the attackers are cyber criminals or have other motives.
Visente AB's Fredrik Blix says the control units sit directly on the public internet with support logins whose password can be obtained the same day; a vendor patch from August never reached thousands of units.
The EU convened its interinstitutional Task Force with ENISA and Europol; the incident follows an October attack on hundreds of French supermarkets and August freezer failures at six U.S. military base commissaries that the Pentagon treats as a suspected hack.

Why it matters

The incident turns an ordinary piece of connected equipment into a way to cause physical damage and public alarm. It also repeats a pattern: Hundreds of French supermarkets were targeted in October, with fires, overheated fridges and spoiled food, and Les Mousquetaires expected damages of several million euros. Pilling's point is that visibility can matter to attackers as much as money, because empty shelves read as shortage and crisis. The EU treated it seriously enough to convene its interinstitutional Task Force with ENISA and Europol, and Commissioner Hansen had already called the weaponization of food a reality.

Who it affects

Retailers first: Delhaize (Belgium and Luxembourg), Colruyt's Spar, Carrefour, Intermarché and IKEA's Mons store in Belgium, ICA in Sweden, Kesko in Finland, Supervalu in Ireland and One Selver in Estonia. Shoppers feel it through discarded stock; IKEA said its restaurant and Swedish Food Market offering saw limited impact. Beyond groceries, Pilling notes that banks, government bodies, manufacturers, utilities and retailers all rely on connected systems managed remotely. The U.S. military is also in the picture through the late-August freezer failures at six base commissaries.

How to use it

This is a news report, not a guide, and it does not offer a defence checklist. The practical points it does carry come from the experts. Blix says the vulnerable control units sit directly on the public internet and the vendor patch from August never reached thousands of units, while the oldest models cannot be updated at all. Pilling's lesson is that an attacker needs no extraordinary capability if an exposed system controls something important in the physical world. ICA noted the affected stores were on networks outside its central systems.

How solid is it

The reporting is well sourced. Ahold Delhaize, IKEA, ICA and an Intermarché spokesperson gave statements to CNBC, and the Colruyt and Carrefour figures come via Reuters and the BBC; Carrefour had not responded to CNBC. The 50°C figure is a peak from at least one store, which is not named. Delhaize's count is only "dozens", so no total number of stores is available. The attacker is unknown: no one has claimed the attacks and investigations continue. Blix's description of the exposed control units rests on researchers' information published in August, and the report does not say which vendor makes the units. The Pentagon link comes from four unnamed people speaking to Reuters.

Risks and caveats

Motive is open. Pilling says the jury is out on cyber criminals versus other intents; Blix argues the silence rules out ransomware crews and offers two options, doing it because they can, or stirring unease in Ukraine-supporting countries without leaving fingerprints. That is his reading, not an established finding. CNBC says there is no evidence AI played a role in these attacks. Pilling expects AI to play a significant role in orchestrating such attacks in future, and the NCSC's new report says AI-powered ransomware against critical infrastructure will become increasingly likely over the next two years. The Delhaize stores are reported back to normal, but IKEA and others were still investigating.

“The lesson from these incidents is that an attacker doesn't necessarily need an extraordinarily sophisticated capability to create disruption if they can find an exposed system that controls something important in the physical world”

— Rafe Pilling, senior director of threat intelligence at Sophos Counter Threat Unit