Shop staff in southern Sweden arrived on Monday to find their freezers blowing hot air, set remotely to 50 degrees Celsius. In Belgium, cooling failed in dozens of supermarkets overnight. Three weeks after hackers struck hundreds of French stores, the incidents expose a gap in EU cyber rules.

During the night to Monday 2 November, someone got into the cooling system at ICA Kvantum in Sjöbo, a small town in Skåne, and set the freezers to 50 degrees. Normally they hold minus 18. The store wrote on Facebook that its fridges and freezers had been hacked. Staff threw out the stock and opened late. Other ICA stores reported the same overnight failure, and rival chain Coop counted six affected shops.

In Belgium, Delhaize and Carrefour reported cooling failures in at least 55 supermarkets the same night, according to VRT. Whether hackers caused those remains unclear. The EU has already sounded the alarm once. After the French attack in October, Agriculture Commissioner Christophe Hansen warned that “food security requires more attention at all levels, because the exploitation of food has become a reality”. On Monday, he is in Ankara for talks with Türkiye that include food security.

A blueprint from France

The pattern looks familiar. On the night of 11 October, attackers took control of refrigeration systems at hundreds of French supermarkets and pushed them to 50 degrees. Intermarché said fridges in around 150 of its stores heated up for six hours. Carrefour counted 80 affected supermarkets. Meat, frozen goods, and vegetables went into the bin, and several stores caught fire.

The Paris prosecutor’s office called the attack “large-scale”. Prime Minister Sébastien Lecornu ordered France’s National Cybersecurity Agency (ANSSI) to investigate. The agency said it was coordinating with its European counterparts, since stores in other countries could use the same software. Investigators have not publicly named a culprit.

In France, the attackers went through internet-connected controllers made by Danfoss, a Danish manufacturer. Danfoss said it had previously advised supermarkets to update the affected models. In October, ICA told the news site Nyheter24 that it had suffered no similar incident.

The Swedish chains have not said which equipment failed on Monday. ICA has not confirmed a cyberattack, speaking only of an incident in “a limited number of stores”, a spokesperson told Reuters. In Sjöbo, staff could only watch. “We cannot adjust the temperatures, we cannot change them. Heat is blowing into the freezers. Everything is ruined,” Rickard Nilsson, who runs the store, told TV4.

Rules that stop at the shop door

This is the uncomfortable part. Under EU law, the supermarket freezer is largely on its own. The NIS2 directive treats food as a critical sector, but only in factories and wholesale warehouses. Retail trade falls outside its scope, as the Finnish Food Authority spells out. The shop round the corner, where people actually buy their groceries, has no duty under NIS2 to manage cyber risks or report an attack.

Heat is blowing into the freezers. Everything is ruined.
— Rickard Nilsson, ICA store manager in Sjöbo

The Cyber Resilience Act should close the gap from the other end, by forcing manufacturers to build secure devices. Since 11 September, they must report actively exploited flaws in their products within 24 hours. The requirement to make products secure by design applies only from 11 December 2027. Until then, an internet-connected fridge controller can reach the market without it. In May, Commission Executive Vice-President Henna Virkkunen told lawmakers that the swift implementation of these rules was a key priority.

For now, the defence sits with the shops themselves. Swedish cybersecurity expert Nicklas Keijser urged stores to check whether their cooling units are connected to the internet at all. In Sjöbo, Tomelilla, and Simrishamn, the advice came too late.