Hackers Target Supermarket Refrigeration Systems Across Sweden, Raising Freezer Temperatures to 55°C

Hackers have disrupted refrigeration systems at several ICA and Coop supermarkets across Sweden, destroying food and prompting temporary closures. One store manager reported finding a freezer at 55°C, which highlights the physical consequences of attacks on connected retail equipment.

The disruption follows attacks against French supermarket refrigeration systems, which similarly damaged chilled and frozen stock. A connection between the incidents has not been established.

Affected Swedish stores span Skåne, Öland, Värmland, and reportedly Stockholm. Six Coop stores in Gästrikland and Hälsingland also experienced disruptions, according to Swedish broadcaster SVT.

Refrigeration Failures Destroy Stock

Mats Olsson, the manager of ICA Nära in Böda on Öland, arrived to find water pooling on the floor and a freezer temperature of 55°C. The store’s refrigerators and freezers had reportedly stopped working, resulting in the loss of perishable goods.

An ICA store in Sjöbo temporarily closed while employees discarded spoiled products and worked to restore operations. In Sankt Olof, manager Dennis Vidal reported that staff were emptying freezers as temperatures began to return to normal.

ICA spokesperson Gustaf Nilsson stated that the company is investigating the situation and supporting the affected stores. He emphasized that the refrigeration systems impacted were connected independently from ICA’s central network.

While this distinction does not clarify how attackers accessed the systems, it does bring the independently connected refrigeration infrastructure into the investigation’s scope.

Sweden’s National Cybersecurity Centre, part of FRA, is assisting the affected organizations. Centre director John Billow mentioned that responders are maintaining contact, providing support, and trying to determine what occurred.

The provided Swedish report does not identify any exploited vulnerabilities, malware families, controller models, or the responsible threat actors. It also does not confirm whether attackers changed temperature set points, manipulated defrost cycles, or disabled cooling systems.

Separately, Postimees reported an Estonian refrigeration attack involving remotely altered temperature settings of +50°C. Connections between that incident and the Swedish disruptions remain unconfirmed.

The incidents demonstrate how refrigeration control failures can translate directly into inventory losses and food-safety concerns.

Research into commercial refrigeration controller vulnerabilities has separately demonstrated that compromised supervisory systems can turn off cooling while displaying normal temperatures. No evidence connects those Copeland vulnerabilities to Sweden’s incidents.

For retailers, internet-exposed operational technology warrants attention: restrict management access, enforce multifactor authentication, segment control networks, and monitor configuration changes.

Independent temperature alarms and continuous monitoring can help detect abnormal conditions before equipment disruption becomes widespread stock loss. Investigators still need to determine the initial access method and whether the affected stores shared any refrigeration supplier, maintenance provider, or remote-management infrastructure.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.