Frozen Food, Empty Shelves: Who Is Hacking Supermarket Freezers Across Europe and the US?

A wave of cyberattacks is targeting the cooling systems of supermarkets in Europe and military bases in the United States, spoiling tons of food and raising fears of a wider campaign. The attackers remain unknown, and investigators are considering motives ranging from simple vandalism to cyberterrorism. On Monday, supermarkets across Ireland, Belgium, Estonia, Finland, the Netherlands and Sweden reported widespread failures in their refrigerators and freezers. In Dublin, printed signs taped to empty shelves read: "Some refrigerated/frozen products are temporarily unavailable due to a technical issue." The dairy, vegan, pizza and bread sections were all empty. Major chains, from Carrefour to Ikea stores, reported the same problem. The incident follows a nearly identical attack on between 400 and 700 French supermarkets just weeks earlier. In that case, attackers accessed the systems controlling refrigerators remotely and manipulated the thermostats. They forced products to defrost and, in some cases, raised temperatures to 50 degrees Celsius when the machines allowed it. Losses ranged from tens of thousands of euros to 130,000 euros per store. The attacks were not the first of their kind. According to Reuters and *The New York Times*, at least six US military bases suffered mysterious failures in the refrigerators and freezers of their commissaries and grocery stores in August. Thousands of kilograms of food were spoiled, causing temporary supply problems. The Pentagon and the Army Criminal Investigation Division have reopened the case and are in contact with French authorities on the suspicion that the incidents are part of the same campaign. **Who Is Behind the Attacks?** The supply problems have hit small towns hard. "I don't even understand how someone can do something like this, I don't see the point," said Mathieu Tilman, manager of a Delhaize store in Tourinnes-Saint-Lambert, a Belgian village of about 2,500 people, standing in front of dozens of garbage bags filled with spoiled food. "So many people are dying of hunger, people who don't have enough to eat. How is it possible that we end up throwing away so much food? I find it really distressing," he continued. "It's crazy. I don't see what they gain from it. In reality, it's a form of terrorism," said Rickard Nilsson, manager of an ICA supermarket in Sjöbo, a Swedish town of 8,000. "What is being analyzed is whether this is a prank or if there could be something more serious behind it," Josep Albors, research director at cybersecurity firm ESET, told elDiario.es. Experts are considering several main theories. The first is economic extortion: that the attacks are a show of force designed to coerce stores into paying to prevent future incidents. "The problem with this theory is that the attack has been so strong that companies should take all measures to prevent it from happening again," Albors said. "The second hypothesis is that there is something bigger behind it," the specialist continued. One possibility is hacktivist groups, known for "acting on their own, defending the cause of a country or a movement," Albors explained. The most active in Europe right now are pro-Russian groups, which operate against Ukraine and the countries that support it, but there are also pro-Palestinian and pro-Iranian groups. It is also possible that a state-backed command is responsible. In this case, the goal would be "to cause concern among citizens" and disrupt food supply chains. This is where the cyberterrorism hypothesis comes in: "It is not a far-fetched theory in the current geopolitical context," Albors said. Finally, there is the possibility that "someone is playing to see how much damage they can cause." This hypothesis does not rule out that an actor with little or no experience, using artificial intelligence, could be behind the material losses. Security forces and private-sector specialists have warned for months that this technology has "lowered the barrier to entry" for carrying out offensive actions. **A Hole Open for More Than a Year** The technical impact of the incidents is the result of vulnerabilities known for more than a year and poor security practices. An investigation into the October cyberattack on French supermarkets confirmed this. Danfoss, the manufacturer of the sabotaged refrigerators and freezers, discovered a flaw in its systems and published security patches in March and August 2025. However, many of the affected computer systems had reached the end of their support cycle and no longer received updates. Investigators later discovered that many stores had their refrigeration management panels fully accessible on the internet or protected by weak, default passwords. The French national cybersecurity response team (CERT-FR) asked supermarkets in the country to fix the situation and isolate unsupported devices from the network. In Spain, "it is unusual for supermarkets to outsource remote control of their refrigeration facilities through centralized external systems," sources in the food distribution sector told elDiario.es. This practice "limits the potential scope of a cyberattack and reduces the risk of simultaneous interruptions in different stores." Specialists warn that the chain of cyberattacks could continue against other countries. The intrusion into freezers has shown that exploiting basic security oversights is enough to paralyze an essential service. "What worries me is that, knowing the situation, these systems remain exposed," Albors said.