Hackers Are Remotely Cooking Europe's Supermarket Fridges, and Food Is Spoiling

Hackers have found a new way to hit the grocery aisle: turn up the heat. European supermarkets reported that intruders remotely raised temperatures inside fridges and freezers, spoiling food and emptying refrigerated shelves. At least one store hit 50°C (122°F). Ahold Delhaize told CNBC that dozens of its Delhaize stores in Belgium and Luxembourg were caught up in the incident on Monday, food had to be thrown out, and everything is now back to normal with stores fully operational.

The blast radius stretched well past one chain. Colruyt Group said five of its Spar stores in Belgium were targeted, according to Reuters. Carrefour told the BBC that 15 of its Belgian stores were attacked, and Intermarché said 15 of its 153 Belgian locations were impacted. IKEA confirmed a cyber incident hit refrigerators and freezers at its Mons store in Belgium between Sunday and Monday — the store stayed open while the company inspects equipment, products and installations at its other Belgian sites, with a spokesperson calling the impact on its restaurant and Swedish Food Market limited. Sweden's ICA said a limited number of stores on networks outside its central systems were affected, and Finland's Kesko, Ireland's Supervalu and Estonia's One Selver also reported refrigeration disruptions.

An Intermarché spokesperson told CNBC that security measures contained most of the attack quickly, though a few stores lost stock — nothing like the blowup in mid-October. That earlier wave hit hundreds of French supermarkets and brought fires, overheating fridges and spoiled food. Les Mousquetaires, which owns Intermarché, told CNBC at the time it expected damages in the millions of euros. European Commissioner for Agriculture and Food Christophe Hansen said on X in October that food security needs far more attention because the weaponization of food has become real.

It's not contained to Europe. Commissaries at six U.S. military bases suffered freezer malfunctions in late August, and four people familiar with the matter told Reuters in October that the Pentagon now treats those as a suspected hack while coordinating with French authorities. In one case, a refrigerator's temperature was raised overnight, leaving food melted and wilted by morning.

The trick itself isn't fancy, according to Fredrik Blix, strategic cybersecurity advisor at Visente AB. He said the control units for these refrigerators sit directly on the public internet, with built-in support logins whose passwords could be found the same day, per research published in August. The vendor patched the flaw in August, Blix wrote on LinkedIn, but thousands of units never got the update and the oldest models can't be updated at all. He noted France was hit by the same attack three weeks earlier, when CERT-FR told European operators to pull the devices offline, and asked suppliers and service companies what exactly they did with those three weeks.

No group has claimed responsibility and investigations are ongoing. Interpol's global chief information security officer, Bjorn R. Watne, told CNBC that AI is inflating the scale and intensity of attacks and can target multiple victims at once, calling it an evolution rather than a revolution. Blix said the silence is the most interesting clue, ruling out ransomware crews and leaving two possibilities: someone did it simply because they could, or someone wanted to sow unease in Ukraine-supporting countries without leaving fingerprints.