Supermarket chains in Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden reported cyber-attacks that caused refrigerators and freezers to reach up to 50C. The incidents resemble a recent attack in France that caused tens of millions of euros in food losses. Authorities and retailers confirmed the hacks, with some stores forced to empty shelves and remove products.
The EU food and agriculture commissioner called the attacks a deliberate attempt to disrupt the food supply chain. Security experts said the attacks did not involve extortion but appeared to aim for sabotage. Many refrigeration systems remain exposed to the internet, with known software flaws that have not been fixed. Retailers mobilised technicians overnight to disconnect affected units, and some chains reported only limited disruption to distribution centres.
The head of Sweden’s cybersecurity centre said many operational technology devices need urgent updates. Cybersecurity firms warned that retail is an easy target due to the widespread use of remotely managed systems. The attacks show the vulnerability of critical infrastructure in sectors with large estates of connected devices.
Regulated firms should assess their exposure to similar risks in operational technology and ensure patching and access controls are enforced. Authorities may increase scrutiny of cyber risk in critical supply chains, and further attacks could disrupt food and retail operations again.
