---
title: Hackers Heat Supermarket Freezers in Sweden, Belgium and Ireland Three Weeks After the French Attack
description: Freezers at ICA, Coop, Delhaize and SuperValu stores were remotely switched to defrost overnight, three weeks after the same method hit 700 French supermarkets.
author: Darie Nani (Editor-in-Chief)
date: 2026-11-02T13:31:13.202Z
updated: 2026-11-02T13:36:20.370Z
canonical: https://www.sovereignmagazine.com/article/supermarket-cyberattack-freezers-sweden-belgium-ireland
image: https://cdn.nanimediahouse.com/pexels-a-wide-selection-of-dairy-and-plant-based-products-in-a-supe-17546504.jpg
categories: Business, Supply Chains
content_type: News
region: Europe
publication: Sovereign Magazine
---

Supermarket freezers in Sweden, Belgium and Ireland were remotely switched into defrost mode overnight on Sunday and left to heat up, three weeks after the same method was used on about 700 supermarkets in France.

Staff at ICA Kvantum in Sjöbo, in southern Sweden, found the store's fridges and freezers set to 50°C when they arrived on Monday. "We cannot adjust the temperatures," the store manager, Rickard Nilsson, told the broadcaster TV4. Everything in the cabinets had to be thrown away, food he estimates was worth up to 1 million Swedish kronor, and he described the attack as "a form of terrorism".

The controllers that run these refrigeration systems have been a known target since the French attack on 12 October, when France's national cyber agency told retailers to take them off the internet. In Belgium, the head of a refrigeration installer whose customers were hit on Monday says his company has spent the weeks since then securing their equipment, and that a software update alone does not fix the weakness.

## Dozens of Stores in Sweden, Belgium and Ireland Emptied Their Freezers on Monday

In Sweden, ICA stores reported problems in Skåne, on the island of Öland, in Småland, in Värmland and in Stockholm. The trade paper Dagligvarunytt counted eight affected ICA stores by Monday morning, and the public broadcaster SVT named several more. The temperature inside one freezer at ICA Nära in Böda, on Öland, reached 55°C. Stores in Tomelilla and Mörlunda closed, the Mörlunda store until further notice, and in Sankt Olof the retailer sold food that was still cold at half price and threw out the rest.

ICA confirmed an overnight incident affecting the fridge and freezer systems of "a smaller number of stores" and said it is supporting them. Coop said six of its stores in central Sweden had problems with their fridges and freezers, and later confirmed a seventh, in Sundsvall. Axfood, which owns the Willys and Hemköp chains, said the Gothenburg warehouse that packs its home-delivery orders lost its cold chain.

In Belgium, Delhaize confirmed an "IT incident" affecting refrigeration at about 40 stores, most of them small Shop & Go outlets at Q8 petrol stations and Proxy Delhaize convenience stores, in both Flanders and Wallonia. Carrefour said 15 of its more than 700 Belgian stores were affected, mainly in frozen food, and that all of them stayed open. Colruyt Group reported five Spar shops hit, and Intermarché fewer than 15 of its 150 Belgian stores. At a Proxy Delhaize in Hoepertingen, in Limburg, freezers that normally run at minus 22°C reached 15°C, and the manager, Gerte Bouchet, put the food thrown away at €60,000 or more.

In Ireland, SuperValu removed chilled and frozen products from sale at 13 stores, including Lucan, Blanchardstown, Waterford and Bray, as a precaution. Musgrave Group, which owns the chain, said a "cyber incident" had affected a "specific model" of refrigerator. "Our monitoring systems alerted us to the issue, and we took immediate action," a spokesman said. Musgrave is working with the equipment's suppliers and with cybersecurity specialists, and it is not yet clear whether the Irish incident is linked to the attacks elsewhere.

## About 700 French Supermarkets Were Hit the Same Way on 12 October

The French attack began overnight on 11 October. Attackers took over the controllers that run all of a store's fridges and freezers, first units made by the Danish company Danfoss and then units sold under the Dixell brand, and put the cabinets into forced defrost. Intermarché said its units ran at 50°C for about six hours. Coopérative U said 80 of its nearly 2,000 stores were hit and Carrefour said 80 of its own, while Les Mousquetaires, which owns Intermarché, told CNBC that about 180 of its stores were affected.

> "Food security requires more attention at all levels. Because the weaponisation of food has become a reality."
> — Christophe Hansen, EU Commissioner for Agriculture and Food

Hansen posted that on X on the day of the attack. The next day, France's finance minister, Roland Lescure, told parliament that about 700 of the country's 10,000 supermarkets had been affected. He said the country's food supply was not at risk but that the attack "touches the heart of our food security", and called it "a wake-up call for everyone".

Les Mousquetaires has put its losses at several million euros, and two Intermarché stores in Haguenau, in Alsace, lost €270,000 between them, according to France Inter. Intermarché has said insurance is a sticking point, because policies do not cover this kind of incident. The Paris prosecutor's anti-cybercrime section opened an investigation on 12 October into the food losses and into equipment that began to catch fire.

## French Officials Told Retailers to Take the Controllers Off the Internet

CERT-FR, the French government's computer emergency team, issued [an alert on 12 October](https://www.cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012/) covering Danfoss's AK-SM and AK-SC series and the Dixell and Copeland xweb controllers. It told operators to remove them from the internet, restore access only through a secure VPN or protected network, check the defrost schedules, change default passwords and update the firmware. In an update on 16 October, CERT-FR warned that attack campaigns against the equipment were probably still under way, and that a factory reset alone would leave an unpatched, end-of-life unit vulnerable and certain to be compromised again.

Danfoss said the French incidents affected "a limited number of refrigeration management systems", most of them obsolete AK-SM800 and AK-SC355 units that no longer receive software or security updates. The company says it has long advised customers to keep supported systems on the latest firmware and to replace obsolete ones, and that it is working with them on firmware updates, stronger network protection and removing direct internet exposure. Scans by security researchers after the French attack found thousands of Danfoss control panels still reachable from the open internet, many of them in France.

## Refrigeration Contractors Monitor the Equipment From Outside the Retailers' Own Networks

ICA's stores are owned and run by individual retailers, and ICA said the stores hit on Monday are connected outside its central network. At ICA Nära Sankt Olof, staff regained control on Monday by disconnecting the systems from the internet. Axfood said the intrusion at its warehouse "happened via an [external supplier responsible for the refrigeration plant](https://www.sovereignmagazine.com/article/databarracks-supply-chain-cyber-attack-2026)" and had no connection to its own systems. Coop's head of press, Carlos Cancino, said the problem did not appear to lie in the hardware itself but in how it was connected.

[The controllers are connected to the internet](https://www.sovereignmagazine.com/article/water-utilities-cyber-attacks-seven-states-fbi-epa) so that refrigeration contractors can monitor temperatures remotely. In its alert, CERT-FR told stores to check their insurance terms before cutting the data feed to their refrigeration contractor, and said that limiting access to the contractors' own internet addresses was acceptable only as an emergency measure.

Stephan Moelans, chief executive of the Belgian refrigeration installer Sabcobel, told the Belga news agency that Monday's attack used the same method as the French one, with evaporators remotely put into defrost mode. Sabcobel counted about 20 affected installations among the hundreds it manages in Belgium and spent the night disconnecting them, having started to mobilise technicians at 1am. "In recent weeks we have worked flat out to protect our customers' fridges against this vulnerability," Moelans said. He said a software update is not enough and the installations have to be physically modified, which "requires an investment". "The simplest solution is to manage the fridges via a secured internet connection. Most of our customers have adopted this solution since the attack in France."

In Sweden, Fredrik Blix, a cybersecurity researcher at Stockholm University, told SVT that the weakness had been known for weeks and that the refrigeration suppliers should have taken it more seriously.

## No Group Has Claimed Either Wave of Attacks

Nobody has publicly claimed the French attack or demanded a ransom, and nobody has claimed Monday's. Antoine Hautin of the French cybersecurity consultancy Almond told AFP that the attackers had shown "a certain sophistication" by hitting hundreds of devices at once. The ethical hacker Clément Domingo told the radio station RMC that the method was not especially sophisticated, and described the attackers' aim as "a will to harm, to sabotage and to destabilise".

The Paris investigation is continuing, and in Sweden the national cybersecurity centre at FRA, the signals intelligence agency, is in contact with the affected stores. Its head, John Billow, told SVT that the centre offers support as a matter of routine and is trying to build a picture of what happened.

## FAQ

**Q: What is a Danfoss controller?**
It is the unit that runs every fridge and freezer in a store from one place, setting temperatures, defrost cycles and alarms. Danfoss, a Danish engineering group, sells them to supermarkets across Europe, and many are connected to the internet so that refrigeration contractors can monitor them remotely. The two models Danfoss named after the French attack, the AK-SM800 and the AK-SC355, are end-of-life products that no longer receive security updates.

**Q: What is the difference between IT security and OT security?**
IT security protects computers, email, payment systems and customer data. OT security, short for operational technology, protects the equipment that controls physical machinery, such as the refrigeration controllers in these attacks. So far the attackers appear to have gone after the cooling systems rather than company or customer data, and Axfood said the intrusion at its warehouse had no connection to its own systems.

**Q: At what temperature does frozen food become unsafe?**
EU rules require quick-frozen food to be kept at minus 18°C or colder, with brief rises of no more than 3°C allowed during transport, local distribution and in shop display cabinets. EU food hygiene law also says the cold chain must not be broken, apart from short periods during handling that do not put health at risk. Freezers that reached 15°C or 50°C overnight were far outside those limits, which is why the affected stores withdrew and destroyed their frozen stock.