European supermarket cyberattack hits freezer systems in seven countries

The European supermarket cyberattack that disrupted refrigeration has affected stores in seven countries. Ireland’s 13 SuperValu outlets are back to normal after precautionary food removals, while the incident raises wider questions about the security of connected equipment.

The European supermarket cyberattack disrupted refrigeration systems in seven countries, with stores reporting spoiled stock and temporary disruption to chilled and frozen food displays. In Ireland, Musgrave reported problems at 13 SuperValu shops. Staff removed food as a precaution, and all 13 stores had returned to normal by Monday, 2 November. Musgrave confirmed that food returned to sale had stayed within safe storage temperatures, according to RTÉ’s report.

The incident reached beyond one retailer or country. The BBC report identified affected supermarket groups in Belgium and Luxembourg, Sweden, Ireland, the Netherlands, Estonia and Finland. The cross-border pattern points to a vulnerability in network-connected store equipment, alongside familiar risks to checkouts and customer accounts.

How the European supermarket cyberattack affected freezers

Sabcobel, a Belgian refrigeration company, said the malicious activity changed settings on refrigeration units so that evaporators entered defrost mode. In that cycle, ice melts from cooling components; repeated or prolonged defrosting can raise cabinet temperatures and put food stocks at risk. Sabcobel chief executive Stephan Moelans told Belga’s account the attack began around midnight and technicians started responding at about 1am.

Moelans said about 20 affected units were identified among hundreds managed in Belgium. The BBC and Reuters coverage described a Swedish store where freezer temperatures reached 50°C; a Belgian branch estimated losses at about €100,000. The figures cover individual cases; aggregate Europe-wide losses remain unreported.

As a result, retailers closed affected cabinets, removed food and temporarily took some stores out of service when temperature controls failed. Cyber agencies in Belgium and Sweden monitored the incident, the BBC reported. The UK’s National Cyber Security Centre told the broadcaster it was working with partners and recorded zero UK incidents at the time. Attribution and the entry route remained under investigation in the public accounts reviewed for this report.

Why connected refrigeration creates a wider business risk

Modern stores use networked controls to monitor temperatures and manage energy use across many cabinets. Remote access helps technicians maintain equipment efficiently, yet the same connections create a route into systems that protect food and support daily retail operations.

Sabcobel’s account suggests attackers altered equipment behaviour alongside familiar tactics such as file encryption or website disruption. Sabcobel said technicians disconnected affected units. The company also warned that software updates need to accompany measures that restrict control-system access. That assessment comes from the equipment provider involved in the response; the public accounts leave the attacker and entry route unconfirmed.

The consequences can move quickly from an engineering fault to a consumer and supply-chain issue. A cabinet outside its safe temperature range can trigger stock disposal, shop-floor disruption and checks on food safety. Affected businesses also need to confirm which units share a control network, how remote access is protected and how quickly staff can isolate equipment.

What shoppers and supermarket operators should do

Meanwhile, Irish shoppers can follow advice from their local store. Musgrave said affected SuperValu shops had resumed normal operation and confirmed safe storage temperatures for food on sale. Customers who bought chilled or frozen items from a particular affected shop and have a concern can contact the retailer with the purchase details and follow its current guidance.

For household storage, the Food Safety Authority of Ireland advises keeping a fridge at 0–5°C and a freezer at around −18°C, according to its FSAI guidance. Its guidance on power interruptions also recommends keeping doors closed and checking food condition and temperature before use. Consumers can use recall notices and official food-safety advice for product-specific guidance.

Retailers and facilities teams can review remote access, separate refrigeration controls from general office networks, remove unused accounts, apply supplier security updates and test manual operating procedures. They should also establish who can isolate a unit and how staff record temperatures during an outage. The European Commission has pointed to EU cybersecurity rules including NIS2 and the Cyber Resilience Act as part of the wider response to risks affecting essential services, according to RTÉ’s report.

Frequently asked questions

Which countries were affected by the supermarket cyberattack?

Reports identified stores in Belgium and Luxembourg, Sweden, Ireland, the Netherlands, Estonia and Finland. The BBC described affected chains across seven European countries.

Were SuperValu stores in Ireland affected?

Yes. Musgrave said 13 SuperValu stores were affected. The retailer said all had returned to normal operations after precautionary food removals.

Is food from the affected Irish stores safe?

Musgrave said food placed on sale had remained within safe storage temperatures. Shoppers with a product-specific concern should contact the retailer and follow official food-safety guidance.

How did the attack affect refrigeration?

Sabcobel said malicious activity switched refrigeration evaporators into defrost mode, raising temperatures in some cabinets. Public accounts leave responsibility unassigned.

What can supermarket operators do to reduce the risk?

Operators can restrict and monitor remote access, separate operational technology from office networks, update equipment and practise isolating affected units while preserving temperature records.