Hackers Hijack Swedish Supermarket Fridges and Raise Freezer Temperatures to 55°C

Hackers have reportedly targeted refrigeration systems at Swedish supermarkets, leaving stores with spoiled food after freezers reached temperatures as high as 55°C.

Several ICA locations and six Coop stores were affected overnight into November 2, forcing staff to clear damaged stock and restore cooling systems. The incidents follow similar attacks against French supermarkets in October, although no connection has been confirmed.

According to Swedish broadcaster SVT, ICA Nära store manager Mats Olsson found water on the floor when he arrived at his shop in Böda, Öland. He reported a freezer temperature of 55°C, with refrigerators and freezers knocked out and their contents ruined.

Swedish Stores Face Food Losses

Affected ICA stores included locations in Sjöbo, Tomelilla, Brösarp and Sankt Olof in Skåne. Reports also covered Öland, Värmland and Stockholm. Six Coop stores in Gästrikland and Hälsingland were affected, but the full number of Swedish stores involved remained unclear.

The ICA store in Sjöbo temporarily closed after reporting temperatures around 50°C. In Sankt Olof, store manager Dennis Vidal said workers were emptying freezers as cooling began to return, but the food was already ruined. At ICA Baronen in Stockholm, staff reported temperatures rising from 38°C to around 50°C.

ICA press officer Gustaf Nilsson said the company was investigating and helping affected stores. Importantly, ICA said the affected shops had connections outside its central network. That distinction does not establish how attackers gained access, but it means the incident should not automatically be described as a breach of ICA’s central systems.

The Swedish reports have not identified the controller brands, entry point, exploited software flaw or attackers. There is also no confirmed evidence that the same group targeted stores in Sweden and France. Any claim naming a specific vulnerability would therefore be premature.

However, the earlier French incidents show why connected cooling equipment needs close attention. Cybersecurity News previously reported on supermarket refrigerators being remotely manipulated, with attackers reportedly changing settings to keep equipment in defrost mode. This function normally clears ice, but prolonged operation can raise temperatures and destroy stock.

France’s national cyber response team, CERT-FR, confirmed compromises involving Danfoss AK-SM and AK-SC controllers, alongside Copeland xweb and Dixell xweb devices. Its official refrigeration security alert warned against exposing management interfaces directly to the internet. These findings concern the French incidents, not confirmed equipment at Swedish stores.

A related Cybersecurity News report on exposed Danfoss systems highlighted how widely refrigeration management pages could be reached online. Such exposure creates a direct route to equipment that controls physical conditions, rather than only business records or payment systems.

CERT-FR advises operators to remove public internet access, check controller settings, including defrost schedules, and restore remote access through a secure VPN or protected network. It also recommends firmware updates and changing default passwords. Operators should coordinate changes with refrigeration providers, including checking insurance terms before interrupting monitoring connections.

The agency also warns that resetting an unsupported controller is not enough. Without removing exposure and addressing the underlying weakness, the equipment can be compromised again, putting replacement stock at risk once cooling resumes and stores begin restocking their shelves.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.