EU task force probes supermarket freezer hacks as German police investigate

Ahold Delhaize said an incident hit refrigeration systems in dozens of Delhaize stores in Belgium and Luxembourg on Monday. Food had to be discarded, and the company says stores are fully operational again.

For shoppers the visible result is empty shelves; for retailers it is stock written off. For regulators it is now a question about contingency plans. Nobody has publicly identified the attacker.

Colruyt Group said five of its Spar stores in Belgium were targeted, and Carrefour told the BBC that 15 of its Belgian stores were attacked. Intermarché said 15 of its 153 Belgian stores were affected. ICA, Sweden's biggest grocery retailer, confirmed an incident at a limited number of stores that sit on networks outside its central systems. Kesko in Finland, Supervalu in Ireland and One Selver in Estonia also reported disruptions to their refrigeration systems. Coop stores in Sweden were also hit, according to Tom's Hardware.

IKEA said a cyber incident affected refrigerators and freezers at its Mons store in Belgium between Sunday and Monday. The store stayed open while the company inspected the affected equipment and products and checked installations at its other Belgian stores. A spokesperson said the impact on the restaurant and the Swedish Food Market was limited.

Heise reported on 3 November that an Edeka store in Reisbach in Lower Bavaria had its cooling systems heated to 50°C overnight to Monday. Large amounts of food had to be thrown away.

The operator published a photo of food in a waste container on Facebook and wrote that the episode made staff angry. It defended the store's internet connection, saying remote monitoring catches power cuts and refrigerant loss at night. Heise also reported first German cases in North Rhine-Westphalia. The Niederbayern police plan to coordinate with authorities in the other affected countries.

The pattern has crossed the Atlantic before. Commissaries at six U.S. military bases suffered freezer malfunctions in late August. The Pentagon is treating those as a suspected hack and coordinating with French authorities, four people familiar with the matter told Reuters in October.

Regulators step in

CNBC reported on 3 November that the EU Commission is in direct contact with national authorities.

Politico reported on 2 November that Agriculture and Food Commissioner Christophe Hansen will put the attacks on the agenda of the next meeting of the Security College. The session is meant to assess retailers' contingency plans and their ability to respond to incidents. "Europe's food supply chain must be prepared for new and evolving threats," Hansen said. He added that the repeated cyberattacks on supermarkets were deeply concerning, causing economic losses for retailers and empty shelves for consumers.

The French precedent and the hardware

This is the second wave in a matter of weeks. In October, hundreds of French supermarkets were targeted in a cyberattack that caused fires, sent fridge temperatures up and spoiled food. Les Mousquetaires, which owns Intermarché, told CNBC at the time that it expected damages of several million euros.

Heise reported on 3 November that the French attacks exploited security gaps in older, internet-connected Danfoss control devices. The attackers did not simply switch the fridges off; they raised temperatures well above safe levels, and the food spoiled. Whether the new cases used the same method has not been confirmed.

Tom's Hardware reported on 2 November that Belga News Agency put the start of the Belgian wave at around midnight on Sunday. Sabcobel, a refrigeration fitter in the region, estimated that at least twenty units were affected across Belgium. Stephan Moelans, the company's CEO, said physical modifications to the units are required, and that a secure internet connection is the simplest interim fix. Most of Sabcobel's customers had already done that after the France attack, according to the report.

Intermarché said a few of its stores suffered stock losses, though nothing comparable to the mid-October attack. The bulk of the attack hit other players in the sector, notably Carrefour and Delhaize, a spokesperson said.

What is still unknown

Bavarian police have not confirmed that a cyberattack caused the Reisbach incident, and it is unclear whether the German cases are connected to the others.

The German federal information security office, the BSI, issued a warning in response to the new cases. It pointed to earlier attacks in Poland and described those as purely destructive sabotage that would have been easy to avoid. Its core advice was to disconnect the systems from the internet, and to use VPN tunnels, multi-factor access, blocklists, protocol filters and updates. The agency said its recommendations apply regardless of any specific attack.

Regulation is tightening anyway. Under the Cyber Resilience Act, manufacturers of connected devices face stricter due diligence duties from December 2027. They have had to report actively exploited vulnerabilities and serious security incidents since 11 September 2026.

What the bill comes to, and who ends up paying it, is still open.