Supermarket cyberattacks expose Europe’s supply chain dependencies

Cyberattacks on refrigeration systems show why cybersecurity must be treated as part of operational resilience—not as a separate IT concern.

A supermarket freezer may seem an unlikely frontline in Europe’s growing cyber threat. But recent incidents show how a digital intrusion can quickly become a physical and operational problem. 

On 2 November, supermarkets in Sweden, Belgium, Luxembourg, Ireland, Estonia, Finland and the Netherlands reported abrupt temperature rises in refrigerators and freezers in suspected or confirmed cyber incidents. Swedish retailers ICA and Coop were among those affected, with one ICA store reporting that its units had been set to 50°C. The incidents echoed the major attack on French supermarkets on 11–12 October, when attackers manipulated refrigeration systems at hundreds of stores, forcing retailers to discard large quantities of food. 

The attacks come as European authorities warn of a growing risk of destructive cyber activity. Denmark has raised its threat level for destructive cyberattacks to high, highlighting the potential manipulation of operational technology. Norway’s National Security Authority has also raised the national cyber risk level to High and urged organizations to take preventive measures immediately.  

The supermarket incidents put a tangible example behind those warnings. Cyber risk is no longer confined to data, computers and corporate networks. When digital systems control physical operations, an intrusion can quickly disrupt products, services and business continuity. Building resilience therefore means understanding not only how to prevent an attack, but how the organization will continue operating when connected technology fails or is compromised. 

What should businesses do now? 

For organizations facing an active incident, the immediate priority is to contain the exposure. Affected refrigeration systems should be disconnected from the internet where this can be done safely, while essential cooling is maintained locally or manually. Before reconnecting, operators should determine which systems genuinely require remote connectivity, verify that they are secure, and restore only the connections needed for operations. Beyond this immediate action, DNV Cyber recommends focusing on three things: 

• Understand the digital dependencies across physical operations 
• Establish clear responsibility and assurance across suppliers 
• Test how essential operations will continue through disruption 

Understand operational dependencies 

Resilience starts with knowing which systems essential operations depend on. Asset inventories should extend beyond conventional IT to include refrigeration, HVAC, access control, building-management equipment and other connected physical systems. Organizations should identify what can be monitored or managed remotely, what processes would stop if it became unavailable, and whether each internet connection is operationally necessary. Systems that do not need remote connectivity should remain disconnected; those that do should be segmented, access-controlled and supported by safe local or manual alternatives. 

Build assurance across suppliers 

Operational resilience depends on more than the security of any individual system. Manufacturers, installers, maintenance companies and technology vendors may all have access or responsibility. Organizations need clear ownership of remote access, updates, vulnerability management and end-of-life decisions—and confidence that critical suppliers can support recovery when disruption occurs. 

Test continuity through disruption 

Response plans should be tested against the operational consequence, not only the cyberattack. Can affected equipment be safely disconnected from the internet without losing essential cooling? Can systems be operated locally or manually while their integrity is verified? Who decides which connections are necessary and safe to restore, and what happens if a technology provider is unavailable? DNV Cyber’s Nordic research found that fewer than half, 49%, of critical-infrastructure professionals feel ready to respond to a cyberattack that disrupts operations or the supply chain, while only 54% report being prepared for the compromise of a direct supplier. 

From cyber incident to physical disruption 

A supermarket freezer is an everyday system, and that is precisely why these incidents matter. We should not assume that the attacks form part of a coordinated campaign or are directly connected to government warnings. But they illustrate the outcome organizations need to prepare for: a digital intrusion producing an immediate physical and operational consequence. As IT and operational technology become increasingly integrated, cybersecurity must become part of how organizations design, test and assure operational resilience. The critical question is not only whether an attack can be prevented, but whether essential operations can continue when connected technology cannot be trusted. 

11/3/2026 9:02:00 AM