50 Degrees: Freezers in Belgium, Sweden, and Luxembourg Fail As Cyberattack Spreads

50 degrees Celsius. That is the temperature reading on the dashboard of an ICA freezer in southern Sweden. Inside the glass doors, thousands of euros worth of meat, fish, and dairy were turning into sludge.

It wasn’t a power outage. It wasn’t a mechanical failure. Someone hacked the thermostat. Dozens of supermarkets across Belgium, Sweden, Luxembourg, and Ireland are dealing with the aftermath of what security firms are calling a coordinated ransomware-style attack on industrial cooling systems.

The food is gone. The damage is real. And the attacker is still unknown.

The Smell of Spoilage in Stockholm and Hoeilaart

The scene at the ICA branch on Odengatan in Stockholm was grim. An employee was photographed tossing bag after bag of rotten produce into oversized black bins. The smell, witnesses said, was overpowering, a sour, metallic funk that hung in the air outside the store. It’s a visceral reality check for a digital crime. You can’t un-hack a steak.

Across the border, in the Flemish Brabant province, the damage was calculated in euros rather than just odor. A Delhaize manager in Hoeilaart told Het Laatste Nieuws that the store lost roughly €100,000 worth of produce in a single night. That figure doesn’t even account for the lost sales during the closure. It’s a painful arithmetic of modern logistics.

Fourteen hours after the initial alerts, the stores were scrambling to restock shelves. In some locations, the fridges were offline completely; in others, they were just running too hot. The distinction matters for the recovery time. A frozen chicken thawed at 50C is trash.

A bottle of wine at 20C is still drinkable. The attackers seemed to understand this nuance. They didn’t just want data. They wanted disruption.

And the disruption wasn’t limited to the hardware. Staff had to manually sort through pallets of inventory, guessing what was salvageable and what was not. It’s grunt work. It’s slow. And it’s a security breach that you can smell from the parking lot.

Who Is Pulling the Levers: The French Precedent

This isn’t the first time we’ve seen this playbook. Last month, hundreds of French supermarkets suffered a similar incident. The pattern is emerging: target the environment control systems, not the point-of-sale terminals. Why?

Because POS systems are hardened. They have air-gapped databases and strict access controls. HVAC systems? Those are often connected to legacy networks, running outdated OS versions, and managed by a single building services contractor who might not even have strong passwords.

It’s a softer target.

Security experts I’ve spoken to over the years have always cited the “Internet of Things” (IoT) as the weak link in physical infrastructure. This incident proves they were right. The attack vector was likely a compromised IP address on the building management network. Once in, the attackers could change set-points, disable alarms, and lock maintenance staff out of the control panel. It’s a digital lockout on a physical asset.

Belgium and Sweden’s national cyber-security agencies are monitoring the situation closely. They are tracking the malware signatures to see if this links to a known ransomware group. So far, no ransom note has been publicly released. That’s unusual.

Usually, there’s a demand. A deadline. A threat to leak data. Here, the demand seems to be pure chaos.

Or maybe the note hasn’t hit the news cycle yet. Or maybe the attackers are testing the waters for a larger operation next week.

Who benefits from food waste? It’s a rhetorical question, but the answer is murky. It could be an eco-terrorist group trying to disrupt supply chains. It could be a hacktivist group making a point about waste.

Or it could be state-sponsored espionage trying to map out vulnerabilities in European retail infrastructure. We won’t know for days, if not weeks. The silence is deafening.

Why This Hurts India’s Tech and Supply Chains

India has a direct stake in this story, whether policymakers admit it or not. Vodafone Idea and other telecom giants have been expanding their IoT security offerings globally. Incidents like this highlight the massive gap in industrial internet security. Indian companies that provide smart grid, smart city, and smart retail solutions are now under scrutiny.

Customers abroad are asking: can we trust your security? That’s a harder sell than it sounds when your competitor’s tech is failing in the NATO countries.

Then there is the supply chain angle. India is a major exporter of spices, cereals, and poultry to Europe. If European retail infrastructure becomes unreliable, importers will demand stricter cold-chain guarantees from Indian suppliers. We might see new certifications required for Indian food exports to Europe.

Costs will rise. Margins will shrink. It’s a ripple effect that starts in a Swedish freezer and ends at a farm in Karnataka.

And let’s not ignore the talent pool. Indian IT professionals are embedded in the cybersecurity teams of major European retailers. They are the ones being called in right now to patch the holes, reset the firewalls, and manage the crisis. For them, this isn’t a news story.

It’s a 72-hour shift. It’s stress. It’s the reality of globalizing labor. The human cost is invisible but present.

Finally, there’s the geopolitical angle. If this is state-sponsored, it’s a signal to any emerging economy like India that critical infrastructure is a target. Our own cold chains, our own power grids, our own water treatment plants run on similar legacy tech. We need to audit them.

Now. Before someone sends a 50-degree command to a warehouse in Gujarat.

The Money Goes Down the Drain

Let’s talk about the bill. In Hoeilaart, it was €100,000 for one store. Multiply that by 40 Delhaize locations. Multiply that by 13 SuperValu shops in Ireland.

Multiply that by 7 Coop stores in Sweden. The total loss is likely in the millions of euros. But that’s just the inventory. There’s also the loss of sales.

There’s the cost of cleaning. There’s the PR nightmare. There’s the legal liability if any customer ate something questionable and got sick. That’s a liability bomb.

Insurance companies are going to be interested in this one. Cyber insurance policies often exclude physical damage caused by cyber events. This is a gray area. Is a hacked freezer a cyber event or a physical event?

Lawyers will be busy for months. Companies will be fighting their insurers over whether to cover the spoiled fish. Meanwhile, the shareholders will be asking hard questions at the next earnings call. How do you explain a 3% drop in revenue due to a hacker in a basement in Moscow or Tehran?

It’s awkward. Delhaize, one of Belgium’s largest chains, described it as a “computer incident.” That’s corporate speak for “we got owned.” Carrefour, the French rival, said only 15 of its stores were affected and that measures were taken immediately. They sounded calm. Controlled. But 15 stores is 15 stores.

It’s not zero. It’s enough to make you sweat. Enough to make you audit your network tonight.

And the irony? The stores are open again. ICA in Sjöbo reopened. Customers are back.

The freezers are working. But the trust? That’s harder to cool down. People don’t forget when their supermarket gets hacked.

They remember the smell. They remember the empty shelves. It’s a brand hit that lasts longer than the software patch.

What Happens Next: The Deadline Nobody Talks About

The next 72 hours are critical. The attackers will likely wait to see if the companies pay up. If they get paid, they’ll know this works. They’ll do it again, in the Netherlands, in Germany, in Italy.

If they don’t get paid, they might leak the data they stole. Maybe not the customer data. Maybe the vendor contracts. Maybe the pricing algorithms.

The threat is always vague, which is the smartest part of the attack. You never know what they have.

Regulators in Brussels and Stockholm are watching. They will likely demand an investigation. They may issue new guidelines for retail cybersecurity. They might mandate MFA (multi-factor authentication) for all industrial control systems.

That would be a good start. It would also be expensive. Small chains will struggle to afford the upgrades. The big chains will adapt.

The small ones will suffer. It’s a digital divide, played out in real-time, in real-time stores.

For the consumers, the message is simple: check your dates. Check your labels. If something smells off, throw it out. Don’t risk it.

The hackers don’t care if you get salmonella. They care about the chaos. We have to be smarter than the malware. We have to be more wary of the fridge than we were last week.

That’s the new normal. That’s the price of doing business in the cloud. The attackers exploited vulnerabilities in the building management systems that control temperature. These systems are often connected to the internet and have weak security. By changing the thermostat settings, they caused the food to spoil, forcing stores to close or throw away inventory.

Frequently Asked Questions

Why did supermarket freezers get hacked?

How much food was wasted in the attack?

At least €100,000 worth of produce was lost at one Delhaize store in Belgium. The total loss across all affected stores in Belgium, Sweden, Luxembourg, and Ireland is estimated to be in the millions of euros, though exact figures have not been released by all companies. It is not yet clear who is behind the attack. Belgium and Sweden’s national cyber-security agencies are investigating. It follows a similar incident in France last month, suggesting a coordinated effort by an unknown group.

Who is responsible for the cyber-attack?

How does this affect Indian food exporters?

Indian exporters may face stricter cold-chain certification requirements from European importers. There is also pressure on Indian tech firms to prove their IoT security solutions are robust against such attacks on critical infrastructure. Customers should check their food for any signs of spoilage, such as bad smells or unusual textures. If in doubt, throw it out. The stores have reopened, but there is no guarantee that all items on the shelves were safe, especially if they were thawed and refrozen.

What should customers do if they bought food from affected stores?

Source: BBC World

Source: BBC World