Supermarket chains across Sweden, Belgium, and Luxembourg reported overnight temperature spikes in refrigerators and freezers on Monday, in what appears to be a second coordinated cyber-attack on Europe's cold supply chain. Sweden's Coop said six stores were hit; ICA confirmed a "limited number" affected. Ahold Delhaize reported an "IT incident" impacting fridges and freezers in dozens of Belgian and Luxembourg stores. The attack pattern is now familiar and spreading. The Belgian footprint was wider than initial reports suggested. Le Soir reported dozens of stores affected, including five Spar outlets, multiple Shop & Go convenience stores at Q8 service stations, and a number of Proxy Delhaize minimarkets. Sabcobel, a refrigeration specialist, had technicians mobilised at 1am, spending the night and morning disconnecting compromised installations from the grid. The response was manual — physically severing internet connections to stop the bleeding. This mirrors the French attack disclosed in October, where hackers seized control of cooling units at up to 700 supermarkets. In that incident, thousands of freezers, fridges, and chiller cabinets were pushed from as low as -27°C to above 50°C. Intermarché, Coopérative U, Carrefour, Leclerc, and Monoprix were all hit. Stores discarded vast quantities of fresh meat, dairy, and frozen products, with individual losses ranging from tens of thousands of euros to over €130,000. Two Alsace stores reported a combined €270,000 in losses. The attack vector is both simple and systemic. Most supermarket cold aisles are internet-connected for remote maintenance and failure alerts. In the French attack, hackers pirated controllers mostly supplied by Danfoss, the Danish manufacturer. They disabled alarm systems before adjusting thermostats or extending defrost programmes by hours. Danfoss acknowledged it had identified security flaws the previous year and had "long recommended" customers install updates. ANSSI, France's national cybersecurity agency, subsequently confirmed that controllers from two additional manufacturers were also targeted — meaning the vulnerability is not one company's problem but an industry-wide architectural flaw. The core issue is that Europe's food cold chain was networked for convenience without security architecture to match. Remote monitoring saves labour costs and catches compressor failures. But those same always-on connections, running on controllers designed for reliability rather than adversarial resistance, created thousands of unpatched attack surfaces across an entire continent. The attackers didn't need to breach corporate IT — they went straight to the operational technology layer, the thermostats themselves. The Paris prosecutor's office has opened a formal investigation into the French attack, noting damage included "food losses and fires." Prime Minister Sébastien Lecornu instructed ANSSI to investigate. But the policy response so far is reactive. There is no EU-wide mandate for cold-chain cybersecurity standards, no required firmware update regime for industrial controllers in food retail, and no centralized threat-sharing mechanism for this specific attack surface. The second wave suggests the attackers learned from the first and expanded geographically. What makes this genuinely dangerous is the combination of low attacker cost and high defender cost. Spoiling food is easy once you're inside the controller. Replacing or segmenting thousands of legacy controllers across tens of thousands of stores is expensive and slow. The asymmetry favours the attacker, and the attack surface is growing as more cold-chain infrastructure comes online across smaller retailers who lack dedicated cybersecurity teams.
