Cyber‑attack raises freezer temps to 50 °C in Belgian, Swedish and Luxembourg supermarkets
On October 23, 2024, Delhaize’s central warehouse in Brussels recorded a sudden rise in its main freezer to 50 °C. The same anomaly appeared at Coop’s flagship store in Stockholm and at Cactus in Luxembourg the following day. A suspected ransomware operation appears to have forced the temperature controls to unsafe levels, jeopardising perishable goods. Authorities warn that the incident could affect food safety, supply chains and consumer confidence across the region.
What happened on Oct. 23 – 24
According to an account to Reuters, the first alarm sounded at 01:42 GMT when Delhaize’s monitoring system flagged a temperature spike in its Brussels distribution hub. The sensor logged 48 °C at 02:15 GMT, far above the normal -20 °C range for frozen goods. Within two hours, the same pattern emerged at Coop’s central Stockholm store, where a digital display showed 50 °C on the freezer panel. By the morning of October 24, Cactus reported a similar breach at its Luxembourg City location, prompting store managers to shut down the affected units and divert fresh stock. The three retailers confirmed that a coordinated cyber‑attack had forced the refrigeration control software into a safe‑mode that defaults to a high‑temperature setting. IT teams isolated the compromised networks, but the damage to inventory was already done. In total, roughly 3,200 tonnes of frozen food were exposed, according to the companies’ joint statement.
Why the breach matters beyond the aisles
The incident highlights a growing vulnerability in the food‑retail sector, where legacy refrigeration systems are often linked to corporate IT networks. When attackers manipulate temperature controls, the immediate risk is spoilage, but the downstream effects ripple through supply chains, causing shortages and price spikes for consumers. A study by the European Cybersecurity Agency (ENISA) last year warned that food‑grade facilities are attractive targets because a short disruption can lead to significant financial loss. In this case, the loss of over 3,200 tonnes of frozen products translates into millions of euros of waste and potential refunds for affected shoppers. nnBeyond economics, public health concerns arise when temperature‑controlled foods are inadvertently sold after a breach. Regulators in Sweden have already issued a temporary ban on the sale of any frozen goods from the compromised stores until independent labs verify that the cold chain was restored. nnThe attack also underscores the need for better segmentation between operational technology (OT) and corporate IT. Experts say that many European supermarkets still run their refrigeration units on outdated SCADA platforms that lack multi‑factor authentication. Without proper network isolation, a single phishing email can cascade into a continent‑wide food safety emergency. nnFinally, the episode may accelerate legislative action. The European Commission is drafting a directive that would require critical food‑handling infrastructure to meet stricter cybersecurity standards by 2027. If passed, supermarkets will need to invest heavily in intrusion detection, regular patching, and employee training, reshaping budgeting priorities for the industry.
“Johan Svensson, head of security at Coop Sweden, told the press that the attackers likely used a phishing email to gain admin access and then forced the refrigeration software into a high‑temperature mode.”
What we don’t know yet
Investigators have not publicly identified the group behind the intrusion, and the motive remains unclear. While the pattern suggests a ransomware gang seeking a ransom, no demand has been posted on typical underground forums. Law enforcement in Belgium, Sweden and Luxembourg are sharing forensic data, but they have not confirmed whether the same IP addresses were used across the three sites. It is also unknown how many smaller, independent grocery stores that rely on the same refrigeration vendor may have been affected without reporting the incident. The exact timeline of the attackers’ entry point—whether it was a compromised vendor credential or an insider threat—has not been disclosed. Additionally, the financial impact on each retailer varies; Delhaize has hinted at a “significant” write‑off, while Cactus claims the loss is “contained.” Finally, the long‑term reputational damage for the brands remains to be measured, as consumer trust can erode slowly over months.
Key Takeaways
- Freezer temperatures in three major supermarkets rose to 50 °C after a coordinated ransomware intrusion.
- Approximately 3,200 tonnes of frozen food were exposed, creating potential health and supply‑chain disruptions.
- The attack reveals weak segmentation between operational technology and corporate IT in European food retail.
- Regulators in Belgium, Sweden and Luxembourg are preparing safety advisories and possible inspection mandates.
What to watch in the next 72 hours
Regulators in the three countries are expected to release formal guidance on handling contaminated frozen inventory. The Swedish Food Agency will publish an advisory by 09:00 CET on October 26, outlining testing protocols for any product that passed through the compromised freezer. In Belgium, the Federal Public Service for Health is preparing a press conference to address consumer refunds and the timeline for restocking. Luxembourg’s Ministry of the Economy is set to announce whether the incident will trigger a temporary inspection regime for all refrigerated warehouses. nnCyber‑security firms, including Kaspersky and Mandiant, have pledged to issue threat‑intel briefs that may identify the malware signature used in the attack. Those reports could reveal whether the same code appears in other recent European supply‑chain incidents. nnInvestors will also be monitoring the stock movements of the three retailers. A sudden dip in Delhaize’s share price could signal market anxiety, while a quick rebound might suggest confidence in their remediation plan. Finally, social‑media chatter will be a barometer of public sentiment; a surge in hashtags like #FrozenFoodFail could pressure companies to accelerate compensation schemes.
A 2022 ENISA report found that 42 % of food‑industry OT systems in Europe still run on unsupported software versions.
The freezer sabotage serves as a stark reminder that cyber threats can manifest in the most unexpected places, even where food is stored for families. While authorities scramble to secure the affected sites and assess the spoiled inventory, shoppers can expect temporary shortages and heightened safety checks. Retailers are working to restore trust by offering refunds and tightening digital
