Second Freezer Sabotage Wave Hits Ahold Delhaize Across Seven Countries

Dozens of European supermarkets lost refrigeration in a second coordinated cyberattack, with about 40 Delhaize-owned stores in Belgium and Luxembourg among the locations where freezers and fridges were remotely forced to heat up.

The attacks struck stores across seven countries: Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia and Finland. Ahold Delhaize, the Dutch-Belgian retail group, confirmed the incident.

"We are aware of an IT incident that affected the refrigeration systems in a number of Delhaize stores," an Ahold Delhaize spokesperson told Supermarket News. "Our teams are working hard to fully assess the situation. We will share further information as soon as we are able to do so."

Who got hit beyond Delhaize?

The attackers didn't stop at one banner. Named victims include:

• ICA — the Swedish grocery giant, with locations affected
• Colruyt Group — which operates SPAR stores in Belgium
• Musgrave — 13 Supervalu stores in Ireland were hit
• Coop — six locations in Sweden were affected

For distributors and operators, the read across these names matters. The targets span multiple countries, ownership structures and IT estates. That points to a shared attack surface — most likely remote management of refrigeration controllers — rather than one compromised vendor network.

According to CNBC, the hackers remotely switched the freezers' evaporators to "defrost" mode. That's a small command with a large bill. Frozen and chilled inventory warms, spoils and becomes unsellable within hours.

How does this compare with the French attack?

This wave follows a similar hack weeks earlier that heated freezers at hundreds of French supermarkets to about 120 degrees, spoiling millions of dollars' worth of food. That earlier incident established the pattern: pure destruction, no ransom demand.

No parties have claimed responsibility for any of the attacks, and authorities have not yet traced the origin. Unlike ransomware that steals data or locks systems, these refrigeration attacks appear to be purely sabotage, CNBC reported.

The timing compounds Ahold Delhaize's exposure. Last month, a separate cyber incident forced the company to shut down its websites across the U.S. and Europe for several days.

The U.S. government is now paying attention too. The Pentagon said last week it has begun investigating similar freezer malfunctions that hit military bases across the U.S. in August. Pentagon officials have contacted French authorities to determine whether there is a connection.

What does the attack volume look like?

Cyber incidents are rising fast in at least one of the affected countries. Belgium's national cyber agency, the Centre for Cybersecurity Belgium, said it received 588 reports of cyber incidents between Jan. 1 and Sept. 28 — already exceeding the 556 recorded throughout all of last year with three months still to run.

"With vulnerability disclosures rising globally and attacks becoming ever faster, the CCB urges enterprises and organizations to adopt basic protective measures immediately," the agency said.

For grocery distribution, the exposure is direct. Cold chain losses hit inventory value immediately. They also hit availability — a store with dead freezers can't sell frozen goods for days, which squeezes turns and pushes waste costs upstream into supplier negotiations.

What should operators do now?

Patrick Lamplmair, chief technology officer and co-founder of Tributech, an Austrian technology middleware company, said operators should ask their suppliers now how commands to their systems are verified.

"Each command should prove its origin and that it was not altered, and each setpoint should be checked against physical limits before it runs," he said in a statement provided to Supermarket News. "A freezer should never accept an instruction to heat to 50°C [about 122°F], no matter who sends it."

That last point is the practical takeaway. Command authentication plus physical-limit validation on setpoints would have blocked this attack class outright, regardless of who the attacker was or how they got in. Vendors of refrigeration control systems should expect those questions from grocery customers — and distributors running their own cold storage should be asking the same ones of their own Building Management System suppliers before this sabotage pattern spreads further.