On the night of November 1, someone accessed the refrigeration systems at ICA grocery stores in southern Sweden and cranked the temperature to 50°C. By morning, employees at ICA Kvantum in Sjöbo were throwing spoiled meat and dairy into industrial bins.
"Everything is ruined," Dennis Vidal, store manager at an ICA location in Sankt Olof, told Swedish media. "We are emptying the freezers right now."
The attack hit at least 23 ICA stores and seven Coop stores in central Sweden, according to Swedish public broadcaster SVT. An Axfood-owned warehouse for online grocery deliveries also lost refrigerated and frozen goods worth about three million Swedish kronor. At the ICA store in Sjöbo alone, the damage is estimated at up to one million kronor.
External Suppliers, External Risk
ICA spokesperson Gustaf Nilsson told Swedish news agency TT that the company's central network was not breached. The affected stores, he said, used an external supplier and had their connectivity outside ICA's main infrastructure. That phrasing suggests the vulnerability lay in third-party refrigeration management systems, not ICA's own IT.
At an ICA Nära store in Böda, on the island of Öland, the manager arrived to find water covering the floor and a freezer displaying 55°C. The defrost cycle had triggered, and in some cases, sprinkler systems activated from the heat.
Sweden's National Cyber Security Centre confirmed it is handling several cases involving disruptions to supermarket cooling systems, though it has not publicly attributed the attack to any specific actor.
A Pattern Across Europe
The Swedish incidents came three weeks after a similar cyberattack hit hundreds of French supermarkets. On October 11, hackers targeted up to 700 stores belonging to Intermarché, Carrefour, Coopérative U, and others, setting refrigerators to defrost mode overnight. Some units in Normandy reportedly reached 80°C. Fires broke out at several locations. The Paris prosecutor opened an investigation into what Coopérative U CEO Dominique Schelcher called an "unprecedented" attack.
French investigators identified Danfoss refrigeration controllers as the attack surface. The Danish manufacturer acknowledged it was "aware of incidents in France affecting a limited number of refrigeration management systems" but has not published a security advisory about the specific vulnerability.
On November 2, the same day as the Swedish attacks, refrigeration failures were reported at supermarkets in Belgium, Luxembourg, Ireland, Estonia, and the Netherlands. Belgian broadcaster RTL Info named Delhaize, Carrefour, Intermarché, and Spar among the affected chains. Whether the incidents share a common cause remains unclear. Neither ICA nor Coop has said whether the affected stores use Danfoss equipment.
Cold Chain, Hot Target
Supermarket refrigeration systems are increasingly networked, managed remotely via control panels that let maintenance companies adjust temperatures from anywhere. Security researchers have warned for years about internet-exposed industrial refrigerators running on default passwords. One 2019 study found thousands of vulnerable units in supermarkets, hospitals, and restaurants across the UK, Ireland, Sweden, and Germany.
The French attack proved that warning was not hypothetical. The Swedish wave proved it was not isolated. No group has claimed responsibility for either incident. The motive, whether criminal extortion, sabotage, or something else, remains unknown.
ICA and Coop stores affected by the attack reopened by Monday afternoon, according to SVT. The cost of discarded inventory across Sweden has not been tallied. ANSSI, France's cybersecurity agency, is coordinating with other European countries, but as of Tuesday, no indicators of compromise have been published for operators to check their own systems.
