Refrigeration systems in supermarkets across at least seven European countries were remotely hijacked on Monday, with attackers pushing temperatures in fridges and freezers as high as 50°C — the same attack signature seen in France last month. Retailers in Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands, and Sweden confirmed disruptions. Several explicitly called it a cyber-attack. No ransom demands have been made, pointing to pure sabotage. The attack vector is startlingly simple. Internet-exposed industrial controllers — the same class of Danfoss units exploited in the French incident — were remotely commanded to switch evaporators into defrost mode. A few commands to a temperature controller can destroy stock overnight and close stores, as cybersecurity firm Tributech's Patrick Lamplmair noted. Thousands of these controllers were still reachable from the internet after the French attack. The attackers did not need sophistication; they needed persistence and a target list. The damage is distributed but real. In France last month, up to 700 supermarkets were hit, with individual store losses ranging from tens of thousands of euros to over €130,000. Monday's attacks struck retailers including Ahold Delhaize (dozens of stores in Belgium and Luxembourg), Sweden's Coop and ICA chains, Ireland's SuperValu (13 of 223 stores), Finland's Kesko, and at least 17 small shops in the Netherlands. Belgium's Carrefour, Colruyt, Intermarché, and even Ikea reported disruptions. Workers spent overnight hours disconnecting compromised installations. EU food and agriculture commissioner Christophe Hansen called the attacks a deliberate attempt to disrupt Europe's food supply chain and undermine consumer confidence. Sweden's national cybersecurity centre head John Billow acknowledged the country had quite a lot of exposed operational technology devices needing updates. The Paris prosecutor's office has opened a formal investigation into the French attack; France's cybersecurity agency Ansii found controllers from multiple manufacturers were targeted, not just Danfoss. The structural problem is that retail chains run enormous estates of refrigeration controllers, building management systems, and point-of-sale gear — all increasingly internet-connected, all patched with the urgency typically reserved for things nobody thinks about until they break. Danfoss said it identified security flaws last year and had long recommended customers install updates. The updates were not installed. The attackers returned. No group has claimed responsibility. Cybersecurity experts note the no-ransom, no-demands profile suggests state-level sabotage rather than criminal extortion, with suspicion gravitating toward hybrid warfare tactics intensified since Russia's 2022 invasion of Ukraine. But attribution remains unconfirmed. What is confirmed: the attack method is cheap, the damage is immediate, and the exposed surface area has barely shrunk between the first and second waves. The core question is not who did this but why thousands of critical food-infrastructure controllers remain publicly accessible on the internet weeks after a widely reported attack. The answer is that patching distributed operational technology across fragmented retail supply chains is nobody's explicit job — until it becomes everybody's emergency at 1am on a Monday.
