At Least 20 Supermarket Refrigeration Systems Hacked in Belgium, Cold Cabinets in Multiple Countries Heated Simultaneously

At least 20 refrigeration systems in Belgium were breached, which is the explicit system count provided in the material.¹ During the same period, refrigeration and freezer equipment in supermarkets across Belgium, the Netherlands, Sweden and Luxembourg showed abnormal temperature spikes.¹ After remote control of the networked refrigeration systems, some freezers and cold rooms rose to roughly 50 °C.¹ The known 20 systems refer only to the breached Belgian refrigeration systems and should not be taken as the total number of systems involved in the multinational incident.¹

Affected companies are located in the Netherlands and Sweden, including stores owned by Ahold Delhaize as well as ICA and Coop chains.¹ In Belgium, the impacted stores belong to chains such as Delhaize, Carrefour and Spar.¹ These details show that the incident spans multiple countries and retail chains, but the number of affected stores per brand is not listed.¹ Thus, system counts, store counts and the range of companies involved are different metrics, and the existing numbers cannot be used interchangeably.¹

The incident began around midnight on Sunday, and many stores did not notice the temperature issue until several hours later.¹ This detection delay means the onset of the anomaly and the moment stores became aware of it are not the same.¹ The available material does not specify when each store discovered the problem, nor how long the temperature abnormality persisted.¹ Therefore, the reference to “around midnight” describes the approximate start window of the attack, not the time all stores detected or dealt with the incident.¹

The intruders kept the defrost mode running for an extended period, bypassing normal temperature controls and causing a rapid temperature rise.¹ This shows the anomaly was not limited to reading changes; the operating mode of the refrigeration system was also manipulated.¹ Some equipment reached about 50 °C, referring to the temperature of freezers or cold rooms, not the ambient temperature inside the stores.¹ The material does not provide the temperature reached by every affected device, so the ~50 °C figure cannot be treated as a uniform reading for all units.¹

Belgium’s Cybersecurity Centre has been made aware of the incident and continues to monitor developments.¹ Delhaize confirmed that refrigeration systems in some of its stores were affected by an IT incident and said it had taken remedial actions.¹ Carrefour Belgium also confirmed the event was a cyber‑attack, while stating the impact was limited.¹ These two corporate statements address the affected situation and the scope of impact, but the material does not specify the exact numbers behind Carrefour’s claim of limited scope.¹

Swedish ICA Kvantum stores posted on Facebook that their freezer temperatures were raised to 50 °C and suggested a possible hacker intrusion.³ A spokesperson for ICA Sweden confirmed that a small number of stores experienced the incident at night, with refrigeration systems affected.³ However, the company did not confirm whether these incidents constituted a cyber‑attack.³ The stores’ suspicion of intrusion differs from the company’s level of confirmation and should not be presented as the company’s definitive conclusion.³

Other material notes that the affected supermarkets mainly use Danfoss refrigeration controllers that are no longer supported, which could be a potential vulnerability exploited in the attack (a reasoned judgment).² This claim links the controller’s unsupported status to a possible entry point, but it does not confirm that a vulnerability has been verified.² Therefore, the assessment that the devices might constitute a risk source should not be conflated with the confirmed number of breached systems.¹² The existing material also does not provide the specific distribution of these controllers across brands and stores.¹²

In France last month, about 700 stores experienced refrigeration system failures due to a cyber‑attack, leading to the destruction of spoiled food.³ The ~700‑store figure pertains to a prior French incident and is not the store count for this multinational supermarket event.¹³ Compared with the at‑least‑20‑system count explicitly given for Belgium, the French number refers to stores and relates to a different event.¹³ Because the two sets of numbers describe different objects and incidents, they should not be directly compared to gauge attack scale.¹³

The disclosed information confirms multinational equipment anomalies, remote temperature adjustments on some devices, and at least 20 breached systems in Belgium.¹ Different companies’ statements vary: Delhaize acknowledges IT‑related impact on some stores, Carrefour confirms a cyber‑attack, and ICA Sweden does not confirm the nature of the attack.¹³ The material does not provide a total store count for this incident nor indicate overall product loss.¹ Thus, at this stage we can separate the confirmed equipment anomalies and intrusion details, each company’s response, and the still‑unquantified overall impact.¹³