A sweeping wave of coordinated cyber intrusions targeting grocery retail infrastructure unfolded across at least nine European nations on Monday, triggering widespread disruptions to remotely managed refrigeration and freezer systems that pushed internal temperatures as high as 50°C (122°F) and forced operators to discard massive volumes of perishable chilled and frozen stock. The incident has spurred EU authorities to raise urgent alarms over deliberate attempts to destabilize the bloc’s critical food supply chain, coming just three weeks after a separate cyberattack crippled operations at roughly 700 French grocery outlets, resulting in tens of millions of euros in estimated food waste losses.
Across affected jurisdictions spanning Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden, local law enforcement and cybersecurity agencies have launched formal investigations to identify the perpetrators, as no group has yet claimed responsibility for the coordinated intrusions. The string of attacks has amplified longstanding concerns over the vulnerability of internet-connected operational technology, including remote refrigeration monitoring tools, to state-backed hybrid warfare tactics that target civilian critical infrastructure to disrupt daily life without triggering conventional armed conflict.
EU Food and Agriculture Commissioner Christophe Hansen emphasized that the European Commission is treating the series of incidents with utmost gravity, issuing a public warning that additional disruptive cyber events targeting essential civilian services could occur in the near future. Commission spokesperson Thomas Regnier declined to assign formal blame for the attacks publicly, but noted the incidents serve as a stark reminder of how easily malicious cyber activity can upend core public services and directly impact ordinary residents. He stressed that EU member states must adopt a unified, proactive stance to build collective cyber resilience and prepare for comparable future threats.
National responses across the bloc have varied by the scale of local disruption. In Italy, Prime Minister Giorgia Meloni’s administration convened an emergency meeting with national intelligence leadership, noting that the immediate impact of the attacks remained very limited, as the vast majority of the country’s food distribution network runs on up-to-date cybersecurity systems capable of repelling such intrusions. Italy’s national cybersecurity agency confirmed that only four Co-op supermarket locations in Sicily and one retail outlet in Tuscany experienced disruptions, with the prime minister’s office disclosing that all affected sites relied on outdated, poorly secured systems with internet-exposed interfaces and insufficient identity verification protocols.
Belgium reported some of the most severe impacts, with dozens of supermarket locations facing total refrigeration failures, prompting federal prosecutors to open a full criminal investigation. Delhaize supermarket manager Mathieu Tilman expressed profound distress at the attack’s consequences, stating, “I cannot fathom why anyone would do this… It is deeply upsetting to see so much perfectly good food go to waste. Moments like this make you want to walk away from the job entirely.”
In Ireland, retail group Musgrave confirmed that 13 of its SuperValu locations were hit by the cyber incident, with a spokesperson noting that restocking of chilled and frozen product lines at affected outlets was already well underway by Monday. A small number of independent convenience stores in the Netherlands also reported minor operational disruptions, coming on the heels of a separate cyberattack on major Dutch supermarket chain Albert Heijn last month that forced the firm to take multiple in-store services offline. In Portugal, the Mosqueteiros group disclosed that disruptions at seven Intermarché locations were linked to the cyber campaign, which appeared to target a third-party external service provider that manages refrigeration system operations for multiple retail clients. Swedish grocery chain ICA acknowledged that a small subset of its stores experienced unusual refrigeration performance, stopping short of formally confirming a cyberattack, while Sweden’s national cybersecurity agency has launched ongoing monitoring of the situation. Finnish retail conglomerate Kesko reported abnormal temperature readings at a handful of its smaller grocery stores and is conducting internal investigations to trace the root cause, while Estonian public broadcaster ERR confirmed that at least one national supermarket location was hacked, with perpetrators deliberately raising refrigeration unit temperatures to 50°C.
Across the English Channel, the UK’s National Cyber Security Centre (NCSC) has issued an urgent advisory to all British food retailers, mandating immediate software updates for all remote fridge and freezer temperature control systems. NCSC director Richard Horne warned during an appearance on BBC Radio 4’s Today programme that the UK faces a high likelihood of an AI-powered cyberattack targeting critical national infrastructure within the next two years. Horne confirmed that the NCSC has already identified a small number of instances in the UK where vulnerable connected food supply chain technology has been exploited by malicious actors, and agency teams have been working around the clock to alert all organizations across the entire food distribution ecosystem that run exposed, unpatched systems at high risk of similar intrusions.