Supermarkets across seven European countries have been hit by a coordinated cyberattack that targeted the refrigeration and freezer systems inside their stores, according to reports by the BBC. The attackers raised the temperature of the affected cooling systems to as high as 50 degrees Celsius, destroying food worth millions of euros. Around 40 Delhaize supermarkets in Belgium and Luxembourg were among those hit, and stores in Sweden, Ireland, the Netherlands, Estonia, Finland and France were also affected. Belgium's Centre for Cybersecurity, the country's national cybersecurity authority known as the CCB, has confirmed the attack on supermarket cooling systems.
Freezers turned against the food they store
The defining feature of the attack was its aim: rather than stealing data or demanding a ransom, the perpetrators manipulated the cooling equipment itself. According to the BBC's reporting, the temperature of the targeted refrigeration and freezer units was pushed up to 50 degrees Celsius, a level at which chilled and frozen food spoils rapidly.
The consequence was large-scale food loss. Food worth millions of euros is reported to have been destroyed as a result of the temperature manipulation, making this an incident whose damage was measured not in stolen records or locked files, but in ruined stock sitting on shelves and in cold rooms.
The fact that stores in seven countries were affected in a single coordinated action points to a deliberate campaign against supermarket cooling infrastructure across borders, rather than a series of disconnected local incidents. Modern commercial refrigeration in large retail chains is typically networked, allowing companies to monitor temperatures and energy use across many locations remotely. That connectivity, which helps chains manage thousands of individual units efficiently, also means that a successful intrusion can potentially affect numerous stores at once, as appears to have happened here.
Around 40 Delhaize stores hit in Belgium and Luxembourg
The clearest picture of the damage comes from Delhaize, the supermarket group whose stores were affected in Belgium and Luxembourg. Around 40 of its supermarkets across the two countries were hit, according to the reporting, giving an indication of how many individual outlets a single coordinated intrusion of this kind can reach.
The attack, however, was not limited to Delhaize or to the Benelux region. The countries where stores were affected are:
- Belgium and Luxembourg, where around 40 Delhaize supermarkets were hit
- Sweden
- Ireland
- The Netherlands
- Estonia
- Finland
- France
The geographic spread, stretching from western Europe to the Nordic and Baltic countries, underlines the coordinated nature of the operation and the breadth of the systems the attackers were able to reach. The available reporting has not detailed how individual stores responded to the incident or how quickly normal refrigeration was restored, but the scale of the destroyed food suggests the manipulation had a significant and immediate impact on stock in the affected shops.
Belgian cybersecurity agency confirms the attack
Belgium's Centre for Cybersecurity has confirmed the attack on supermarket cooling systems, putting the weight of the national cyber authority behind the reports. CCB spokesperson Katrien Eggers said the agency had received information about the incident but had no further details.
The confirmation matters for two reasons. First, it signals that the incident is being tracked at the national level in a country where dozens of stores were directly affected. Second, the brevity of the CCB's statement, confirming the attack while offering no further specifics, indicates how much about the case remains unknown publicly. The agency has not disclosed who it believes is responsible, how the attackers gained access to the cooling systems, or what steps are being taken in response.
Key questions remain unanswered
Several central questions have not been answered in the available reporting. The identity and motive of those behind the attack have not been made public, and it is not clear precisely when the temperature manipulation occurred or over what period it lasted. Details on how the attackers penetrated the refrigeration systems, and whether other store systems were touched, have likewise not been released.
What is established is the scale of the impact. Food worth millions of euros was destroyed, roughly 40 Delhaize supermarkets in Belgium and Luxembourg were hit, and stores in six additional countries were caught up in the same coordinated operation.
The incident is a stark illustration that cyberattacks do not only target data, payments or office networks. Connected equipment that quietly keeps food cold can itself become the target, with physical and financial consequences. In this case, the losses were concrete: ruined stock, disrupted stores and a clean-up bill running into the millions of euros, spread across the refrigerated aisles of shops in seven countries at once.
