A cyberattack targeting refrigeration systems has caused widespread disruption for multiple supermarket chains across Europe. Attackers remotely altered temperature settings in freezers and cooling units, in some instances activating defrost cycles or shutting down systems entirely. This led to temperatures soaring, resulting in substantial product spoilage and requiring early morning interventions by store managers. ### Broad Impact Across Europe The incident has affected more than 115 stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia. While the full scope is still being assessed, it remains unclear if these were part of a coordinated attack or individual targets exploiting a common vulnerability. Supermarket chains that have publicly acknowledged issues include: * **ICA** (Sweden) - At least 4 locations * **Coop** (Sweden) - 7 confirmed locations * **Ahold Delhaize** (Belgium and Luxembourg) - Approximately 40 locations * **Carrefour** (Belgium) - 15 locations * **Spar Colruyt** (Belgium) - 5 locations * **Intermarché** (Belgium) - Approximately 15 locations * **SuperValu** (Ireland) - 13 stores * **Selver** (Estonia) - 1 store Beyond major chains, at least 17 butcher shops and neighborhood stores in the Netherlands, an **Ikea** superstore in Mons, Belgium, and various grocery and chocolate shops in Belgium have also reported similar problems. ### Companies Respond to Crisis Spokespersons for **ICA**, **Ahold Delhaize**, and **Spar Colruyt** confirmed the incidents, stating their companies are providing support to affected stores and actively working on resolutions. **ICA**'s press officer noted, "The incident impacted the stores’ refrigeration and freezer systems. ICA is currently supporting the affected stores in managing the situation." **Ahold Delhaize** stated they "immediately took the necessary measures to keep our stores operational" after identifying an IT incident affecting refrigeration systems in dozens of stores. **Coop** reported that issues ranged from "completely shut-down refrigerators and freezers to partially functioning units, and in one case, the system beginning to generate heat." In Belgium, **Carrefour** reported a limited impact, with only 15 of 700 stores affected, primarily impacting freezers. All hypermarkets remained operational. ### Technical Details and Vendor Vulnerabilities An **ICA** store manager reported that temperature settings were changed overnight to an alarming +50°C (122°F) and could not be overridden, forcing the discarding of frozen food. **Ahold Delhaize** reportedly alerted managers via SMS around 4 a.m., with some stores resorting to refrigerated trucks to save stock. **Sabcobel**, a vendor of refrigeration systems for several affected locations, has been identified. According to **Stephan Moelans**, **Sabcobel**'s director, the attackers exploited the same vulnerability used in similar attacks last month in France. **Moelans** indicated that technicians began disconnecting affected installations around 1 a.m., attributing the disruption to remotely activated defrost functions. He emphasized that a simple software update is insufficient, as physical modifications to the refrigerators are also required. "The simplest solution is to manage the refrigerators via a secure internet connection. Most of our clients have adopted this solution since the attack in France," **Moelans** told RTL. The previous attacks in France impacted hundreds of stores utilizing **Danfoss AK-SM/AK-SC** and **Copeland/Dixell XWEB** refrigeration controllers, which were similarly compromised to initiate defrost modes.