A cyberattack targeting connected refrigeration systems has caused significant food spoilage at grocery stores across Sweden and several other European nations.
Impact on Swedish Retailers
The incident affected multiple major grocery chains. ICA-gruppen confirmed that a minor number of stores
with systems connected outside the company’s central network experienced disturbances in their cooling operations, according to Gustaf Nilsson, press officer at ICA. In Sjöbo, staff at an ICA Kvantum store discovered that fryers had been set to high temperatures, resulting in the loss of goods valued at hundreds of thousands of kronor.
Additionally, Axfood’s consumer fulfillment center in Västra Frölunda was impacted, disrupting e-commerce home deliveries in the Gothenburg area. According to Magnus Törnblom, press chief at Axfood AB, the intrusion occurred through an external supplier responsible for the cooling system, rather than Axfood’s own internal network.
European Stores Targeted Across Multiple Countries
The attack follows a similar pattern observed in France on October 12, 2026, where approximately 700 stores were targeted. Similar incidents have since been reported in Belgium, the Netherlands, Latvia, and Ireland. In Finland, while some smaller K-stores were affected, the country’s Cybersäkerhetscentret (Cybersecurity Center) noted that kylanläggningar (cooling facilities) within social and health services remain protected against such attacks.
Danfoss, the software supplier for many of the affected systems, stated that it had previously alerted customers to the risks of unauthorized access to these systems. According to reporting by The Guardian cited in Expressen, the company had recommended that clients update their software months before the recent wave of attacks. Fredrik Blix, a doctor in cybersecurity, told SVT that the incident represents a failure for cooling suppliers, noting that the earlier French attack should have prompted more significant security upgrades across the industry.
Claims of Responsibility
Two pro-Russian hacker groups, NoName057(16) and Z-Pentest Alliance, have claimed responsibility for the attacks via social media and dark web platforms. To support their claims, the groups published login credentials for the Danfoss cooling systems, as reported by Cybernews.
The French security firm Sekoia has expressed skepticism regarding these claims, noting that these groups have previously taken credit for actions performed by other actors. Wåhlen noted that an individual or Russian intelligence might be using such groups to maintain distance from the actual sabotage.
Response from Authorities
The National Cybersecurity Center has been engaged to support the affected organizations and assess the scope of the incident. As the investigation continues, European cybersecurity centers are now collaborating to identify the entities behind the large-scale disruption, amid concerns that such vulnerabilities could be exploited to target more critical infrastructure, such as water and sewage systems.