On Monday morning, staff at an ICA Kvantum store in Sjöbo, Sweden, arrived to find supermarket freezers hacked and their cold chain already failed. The store said on its Facebook page that its fridges and freezers had been hacked overnight, with temperatures remotely raised to 50 degrees Celsius. Employees unloaded spoiled food into carts. It was, in miniature, the whole story of the day: food ruined not by a broken compressor, but by a setting changed from somewhere else.
A morning of supermarket freezers hacked across several countries
The reports on 2 November were not confined to one shop, or one chain. In Sweden, Coop confirmed unauthorized access to and tampering with cooling systems at a small share of its stores. The reported scope differs by source: Coop was reported to Swedish newspaper Aftonbladet as having six stores hit, while a Reuters factbox put the figure at seven of about 800 stores. ICA, Sweden’s other large grocer, reported disruption at a small number of stores using an external supplier.
In Belgium and Luxembourg, Ahold Delhaize described an IT incident that adjusted the temperature of refrigeration units in dozens of its supermarkets. About 40 Delhaize stores in Belgium were reported affected. Colruyt Group said five Spar franchise stores in Belgium had their refrigeration systems attacked, and Carrefour Belgium was reported at 15 stores, which remained open. Estonia was also named among the countries affected, although the accessible Verge account gave no incident detail for Estonia.
The language matters, because the companies did not all use the same words. One Swedish store said it was hacked. Coop spoke of a cyber incident involving unauthorized tampering. Ahold Delhaize spoke of an IT incident under investigation. Those are not interchangeable descriptions, and they are a first warning against treating every report on the day as a single, confirmed event.
The connection that was supposed to help
Modern supermarket refrigeration is not a sealed box. Units are connected to the internet so technicians can monitor them remotely, receive failure alerts, and service them without travelling to every store. That connection is the reason a fault can be spotted at night, before the morning delivery. The reported cases suggest that same connection could allow a temperature setting to be changed without anyone entering the store, although entry routes remain unconfirmed.
The clearest technical account so far came from Belgium. Sabcobel, the refrigeration contractor that operates Delhaize’s systems there, told the Belga news agency that units had been switched into defrost mode. It said technicians were sent out from about 1 a.m., and discussed physical modifications and moving units to a secure internet connection as fixes.
None of this, on its own, identifies who did it or how they got in. No group has claimed responsibility for the 2 November incidents, and no authority has named a suspect or an entry point in the reporting reviewed for this article. Ahold Delhaize separately reported a cybersecurity incident to Dutch police last month, but nothing in the reporting ties that report to the 2 November incident. The mechanism that fits the Belgian account — a controller switched into defrost — is not, by itself, proof of the route used in every country.
France, three weeks earlier
The 2 November reports were described in much of the reporting as a second wave, after a wave of refrigerator incidents in France in mid-October. There, too, the tallies differ by source: some chain statements put the number at about 300 stores, while the French finance minister cited about 700 of the country’s 10,000 supermarkets. Temperatures in some French units were reported at 50 degrees Celsius, and spoilage was estimated in the millions of euros, with some estimates running into the tens of millions. Fires were reported at some sites.
The French incidents involved controllers made by Danish engineering company Danfoss, and Danfoss said most affected systems in France were older products that no longer received software or security updates. A secure internet connection was among the fixes discussed in the Belgian account.
What is still not known
Three questions remain open, and they are the ones that matter most. First, are the incidents in different countries linked to one another, or are separate incidents being reported together because they look alike? Second, by what method and route was access gained in each case — and was the internet-connected controller the entry point everywhere, or only in the cases described in detail? Third, what is the full, confirmed scale, particularly for Ahold Delhaize, whose full scale was yet to be confirmed in the Verge account, and for the countries named without detail?
Until those questions are answered, the honest description of 2 November is narrower than the headlines. A set of reported incidents, in several countries, in which refrigeration temperatures were changed remotely or tampered with, and spoiled food was unloaded by employees at the Swedish store. Some companies call it a cyberattack. Others call it an IT incident. The difference is not pedantry; it is the gap between what is known and what is suspected.
The ordinary machine, reachable from outside
That gap is also why this story is not really about freezers. It is about a design choice made for remote monitoring and maintenance: put the cold chain online, watch it from afar, fix it before it fails. The reported incidents suggest the other side of that choice. A system built so a technician need not travel to a store can also be reached by someone who was never invited in — and the first sign of trouble may be a morning shift, a cart full of ruined food, and a temperature display reading 50 degrees.
What remediation will be sufficient remains unresolved in the evidence supplied. For France, Danfoss said most affected systems were older products that no longer received updates; for Belgium, physical modifications and a secure internet connection were discussed as fixes. Until the entry routes and the full scale are confirmed, the question at the centre of this affair is whether a system built so a technician need not travel to a store can also be exposed in that way — and the reported temperature changes suggest it can.
