A wave of coordinated cyber intrusions targeting remotely managed commercial refrigeration systems has struck food retail and supply chain operations across multiple European nations this week, following a similar large-scale attack in France earlier this October. First reported on Monday, the latest incidents saw threat actors exploit publicly documented vulnerabilities in cold storage control hardware to override temperature settings, switching thousands of supermarket fridge and freezer units to defrost mode and rendering large volumes of perishable fresh and frozen stock unfit for sale.
Countries including Ireland, Sweden, Estonia, Belgium, the Netherlands and Finland confirmed cases of impacted retail locations, with roughly 40 Delhaize supermarket branches across Belgium and Luxembourg reporting disruptions. Belgian refrigeration manufacturer Sabcobel verified that the attacks forced the evaporator components of connected cooling units into defrost cycles, causing rapid, unplanned temperature spikes. The attack vector matches the modus operandi used in early October, when hundreds of French supermarkets were targeted in an overnight hack that destroyed millions of euros worth of food inventory.
In the United Kingdom, the National Cyber Security Centre (NCSC) disclosed that its teams worked through the overnight hours ahead of Tuesday to alert potentially at-risk food sector organisations, after identifying a small number of cases where unpatched, vulnerable refrigeration technology had been exposed to exploitation. No major stock losses have been confirmed in the UK to date, but industry groups have flagged that food supply chain operators across the country are at heightened risk. The British Association of Independent Meat Suppliers (AIMS), which represents more than 300 meat processing and distribution firms, confirmed some of its members had become unintended collateral targets of the ongoing campaign, though no member reported full loss of perishable meat stock.
AIMS head of communications Tony Goodger emphasized that the attacks serve as a critical wake-up call for every stakeholder across the food supply ecosystem, urging full industry vigilance to address unaddressed security gaps. NCSC chief executive Dr Richard Horne noted that it remains too early to attribute the attacks to a specific threat actor, but highlighted a systemic, industry-wide failure to invest in securing legacy operational technology that underpins critical daily services. Horne warned that many organisations continue to run outdated, end-of-life refrigeration and industrial control systems that are never disconnected from public internet networks or segmented into secure, isolated environments, creating easily exploitable “low-hanging fruit” for hackers. He added that the growing accessibility of generative AI tools for malicious actors is accelerating the speed and scale at which these unpatched vulnerabilities can be located and weaponized.
Horne called on all private sector operators to prioritize upgrades for ageing connected infrastructure, noting that while government cybersecurity agencies can provide guidance and intervention support, ultimate responsibility for protecting operational systems falls to the businesses themselves. The British Retail Consortium confirmed that major UK supermarket chains including Asda, Lidl, M&S, Sainsbury’s and Tesco are collaborating closely with the NCSC to audit and harden their refrigeration control systems against potential follow-on attacks, noting that retailers have already made substantial ongoing investments in cybersecurity frameworks.
For frontline food retailers, the human and economic cost of the attacks has been particularly acute. Mathieu Tilman, who operates an independent Delhaize franchise in Belgium, described the mass disposal of hundreds of thousands of euros worth of edible, recently spoiled food as deeply distressing, noting that widespread global food insecurity makes the unnecessary waste feel profoundly unethical, to the point he considered abandoning his business entirely in the immediate aftermath of the breach.