The concentration of reports around legacy controllers and one supplier suggests an attack surface that predates this month's headlines.
Supermarkets in at least seven European countries found their refrigeration systems disrupted on Monday, according to TRT World, with cold cases in Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands and Sweden among those affected. Several chains confirmed they had been hit by a cyberattack similar to one that struck French retailers three weeks earlier. Stores were forced to discard food that had spoiled or risked spoiling and restock their units.
The European Union said it was taking the matter seriously. Food and agriculture commissioner Christophe Hansen called the repeated attacks "deeply concerning" and described them as a deliberate attempt to disrupt the food supply chain and undermine consumers' confidence in it. No one has claimed responsibility for either the French attack of 12 October or Monday's incidents, and the identity and motive of those responsible remain unknown.
The reported pattern points to shared infrastructure rather than a single retailer. Carrefour Belgium said about 15 of its 700 stores were disrupted, and a spokesperson told AFP there was no other explanation than a cyberattack. Ikea Belgium reported an attack on its Mons store that sent freezer temperatures rising in the early hours. Delhaize, Colruyt and Intermarche also reported refrigeration problems in Belgium, and Delhaize said four of its Luxembourg stores were affected. Musgrave, which owns Supervalu in Ireland, said 13 stores were hit, along with a small number of corner shops in the Netherlands. Coop in Sweden confirmed six of around 800 stores were affected, while Ica reported a limited number of incidents it could not attribute to hacking.
Attention has fallen on Danish manufacturer Danfoss, the supplier named in the October attack on French retailers. An Ica spokesperson said the affected stores were connected to an external refrigeration control system provided by Danfoss and referred all queries to the company, which had not responded to AFP's request for comment. In Estonia, public broadcaster ERR reported at least one supermarket where hackers raised unit temperatures to 50C, using older Danfoss-delivered models similar to those targeted in France. Jann Mutso of Kitman Coldtech told ERR that "the handwriting is the same", while declining to say more. After the French attack, Danfoss told AFP that most affected equipment were legacy products no longer receiving software or security updates.
Belgian industrial refrigeration group Sabcobel said it had begun securing installations after 12 October, but roughly 10 percent remained unfixed, some in shops affected on Monday. Its chief executive, Stephan Moelans, told AFP the impact would have been much more important had that work not started. In Finland, Kesko reported irregular temperatures in a few smaller stores and said network interference had not been ruled out; a specialist at the national cyber security centre said the spread beyond France had been expected. Coop's Carlos Cancino noted that affected Swedish stores were connected to a 4G mobile network rather than 5G, which made them more exposed.
What remains unconfirmed is the mechanism of the intrusion, the identity of the attackers and whether the incidents share a single actor. The concentration of reports around legacy controllers and one supplier suggests an attack surface that predates this month's headlines, and the commissioner's warning that food security requires attention at all levels indicates Brussels sees the cold chain as critical infrastructure rather than a retail inconvenience.
