.svg)
Supermarkets across Sweden, Belgium, Luxembourg, and Estonia suffered disruptions to their refrigeration and freezer systems on Monday after apparent cyberattacks, forcing a number of locations to discard spoiled food and limit their fresh and frozen product offerings. The incidents mark the second wave of similar attacks in less than a month, following a separate campaign in France that compromised hundreds of grocery stores by remotely manipulating their cooling systems.
The attacks share a common approach: threat actors gained unauthorized remote access to building and facility control systems, then deliberately sent temperatures soaring. In Sweden, the ICA Kvantum branch in Sjöbo reported that its fridges and freezers were hacked and driven to 50 degrees Celsius (122 degrees Fahrenheit). Sweden's Coop chain confirmed that six of its stores in central Sweden were also affected. ICA Group, one of the country's largest grocery chains, acknowledged "a limited number" of stores were hit overnight but declined to specify further.
Belgium's Delhaize chain reported that an "IT incident" impacted refrigeration systems in several dozen stores, with a handful of additional locations affected across neighboring Luxembourg. The company noted that its distribution centers continued operating normally and that product deliveries remained uninterrupted. Carrefour Belgium, meanwhile, confirmed that 15 of its more than 700 stores were affected, calling the cyberattack's impact "extremely limited" and isolated to refrigeration installations.
In Estonia, technology company Kitman Coldtech CEO Jann Mutso confirmed that one of the firm's clients was hit by an attack in which unauthorized actors accessed a computer controlling refrigeration and spiked temperatures to 50 degrees Celsius. Mutso said the attack was detected and responded to within minutes, limiting significant damage. The Selver chain confirmed one of its outlets was among those affected.
A Pattern Targeting Industrial Control Systems
The back-to-back incidents across Europe point to a deliberate pattern of attacks against operational technology (OT) and industrial control systems (ICS) embedded in everyday commercial environments. Retail refrigeration units are increasingly managed through networked building management systems, and many of these systems run on older software with limited security controls. The France attacks that preceded this wave reportedly targeted legacy infrastructure, suggesting attackers are specifically hunting for outdated, internet-connected OT systems that lack modern defenses.
This is a meaningful shift in threat actor behavior. Ransomware and data theft have long dominated cybercrime headlines, but attacks that directly manipulate physical infrastructure carry immediate, tangible consequences: wasted inventory, public health risks, operational shutdowns, and significant financial losses. The grocery sector, with its thin margins and complex cold chain logistics, is particularly vulnerable.
The broader implication extends well beyond retail. Any organization that relies on networked control systems to manage physical equipment, whether HVAC, refrigeration, manufacturing machinery, or building access, carries real exposure if those systems are not properly segmented, monitored, and patched. Operational technology environments were historically air-gapped from corporate networks, but increasing connectivity has erased that boundary in many facilities without a corresponding increase in security oversight.
Organizations across industries should take this moment to assess whether their facility and building control systems are discoverable from the internet, whether vendor remote access is properly secured, and whether anomalous behavior on those systems would be detected at all. Without visibility into OT environments, attacks like these can go undetected long enough to cause serious damage.
If your organization relies on networked building systems, manufacturing equipment, or any form of operational technology, InfoPathways can help you identify and close exposure gaps before they become incidents. Contact us to schedule a security assessment and find out where your infrastructure stands.