Swedish supermarkets have fallen victim to a cyberattack that raised freezer temperatures as high as 55 °C, causing widespread spoilage of food across ICA locations and multiple Coop stores. The breach started overnight leading into November 2, 2026, triggering cleanup efforts as managers discovered ruined goods and flooded floors in several regions.
Widespread Impact Across Sweden
Managers at ICA stores in Sjöbo, Tomelilla, Brösarp, Sankt Olof, Öland, Värmland, and Stockholm reported their refrigeration systems were compromised. In Sjöbo, freezers lingered near 50 °C before staff shut things down. One manager in Stockholm noted temperatures soared from about 38 °C to 50 °C. Coop stores in Gästrikland and Hälsingland were also affected, though the full scope of the affected outlets is still being assessed.
Unknown Entry Point, Amplified Risk
ICA has clarified that the affected branches weren’t connected to its central network, suggesting the attack may have exploited local systems. However, investigators have yet to establish how exactly the hackers gained access. No specific flaw, controller brand, or malicious group has been definitively linked to the Swedish incidents.
The situation echoes similar attacks in France last month, where vulnerabilities in models made by Danfoss, Copeland and Dixell were exploited to manipulate refrigeration equipment. These earlier breaches involved changes to defrost modes living up to damaging levels. Security teams there flagged risks associated with controllers accessible directly over the internet.
Mitigation Measures Suggested
CERT-FR—the French national cybersecurity authority—has shared several recommendations relevant in Sweden and beyond. These include disabling public internet access to refrigeration controller systems, implementing secure VPNs or protected internal networks for remote access, updating firmware, and replacing default passwords. The agency also urges operators to align with equipment providers and insurers before disabling monitoring systems.
Even interventions like overwriting settings may be insufficient if root vulnerabilities and access exposure are not addressed. Attackers may simply reinfect systems once store restocking begins unless core risks are mitigated.
Why This Matters
Refrigeration systems are critical infrastructure for grocery operations, but increasingly connected equipment has become a growing attack vector. When hackers gain control over environmental controllers, damage extends well beyond data theft—spoiled food hits both public health and merchant profitability.
Similar attacks in France in October targeted Danfoss AK-SM and AK-SC controllers, as well as Copeland xweb and Dixell xweb devices—underscoring how common industrial control hardware is being misused. The key takeaway: visible exposure of these control interfaces over the public internet invites disaster.
As for Sweden, the link between these recent attacks and proven campaigns in France remains unconfirmed. For now, ICA and Coop stores are focused on restoring chilled systems and handling losses.
This Signals a Shift in Threat Landscape
What makes this attack especially alarming is not just the damage—but the methodology. Hacking into refrigeration systems reflects a deeply physical consequence, where food safety, supply chain stability and even local economies are put at risk. It demonstrates how cyber threats are no longer limited to servers or data.
For supermarket chains, food service providers, and any business relying on industrial cooling, this should be a wake-up call. Secure network design, strict access controls, regular firmware maintenance, and proactive risk assessments are now essential defenses. The cost of complacency is no longer just reputation—it’s wasted food, lost revenue, and potentially serious health hazards.
