Second Cyberattack in a Month Drives Up Refrigeration Temperatures and Costs European Grocers Millions in Food Waste

A second cyberattack in a single month drove up refrigeration temperatures at European supermarkets and destroyed millions of dollars in food, forcing grocers to disconnect cold-chain equipment from the internet as an emergency measure, Reuters reported. The fix is immediate. It is not durable.

The attacks struck the region's food retail channel twice in roughly three weeks. Carrefour, the French retail group, saw 80 franchised stores hit by the first attack in France, with 15 more struck in Belgium during the second wave. For a franchised model, in which store-level operators depend on centrally specified equipment and connectivity, that exposure translates directly into inventory write-offs and refrigerated-goods losses.

What Happened at the Swedish Chains?

Coop, the Swedish retailer, reported seven affected stores. The company is now upgrading its systems from 4G connections to 5G networks and more modern modems, Reuters reported. The affected stores have already disconnected their refrigeration systems from the internet entirely — a stopgap that restores temperature control but removes remote monitoring, the operational feature that made the equipment efficient in the first place.

A Coop spokesperson told Reuters the company is examining the status of its entire store network "thoroughly and deeply" to determine whether any part of it remains vulnerable. That phrasing deserves scrutiny. It signals an audit in progress, not a completed assessment, and it does not say how long the disconnect-and-inspect posture will last.

ICA, which also operates in Sweden, told Reuters that all its stores hit by the attack had equipment connected outside the chain's centrally managed store network. That detail matters for channel economics: distributed equipment purchasing, in which local units attach devices beyond the corporate network perimeter, widened the attack surface. ICA was already changing its security systems after the first attack — a timeline that shows the first response did not prevent the second incident.

Who Was the Target, and What Is the Fix?

Danfoss, the software provider whose systems were targeted again in the second wave of attacks, recommended disconnecting from the internet while it works with grocers to develop a better safeguard. Note what is absent. No vendor has yet offered a replacement architecture with a stated deployment date, and no grocery operator has disclosed the full cost of the wasted stock or the remediation spend.

Swedish police have received about 10 reports related to the attacks, and more are expected.

A structural complication slows any coordinated defense: many European grocers operate independently and are not tied to the same system. That fragmentation, common in the region's food retail sector, means security standards vary by operator, and a fix validated at one chain does not automatically protect its neighbors.

The economic logic of the interim measure is straightforward but costly. Disconnecting refrigeration from the internet stops the attack vector, yet it also disables the telemetry that supports remote temperature management and energy optimization — the very capabilities retailers installed to cut operating costs. Whether 5G modem upgrades and network segmentation can restore that functionality safely remains unproven until the next attempted breach tests them.