Supermarket aisles in Belgium looked unusually bare this week as a cyberattack knocked out refrigeration systems, leaving dairy, meat, and frozen goods to spoil. The attack, which hit multiple outlets, forced stores to cordon off entire sections of fridges and freezers, with some locations temporarily closing their doors.
The disruption was felt most acutely in Brussels and Antwerp, where shoppers encountered empty shelves and apologetic staff. One manager in a Delhaize store in the capital described the scene as “a ghost town for fresh produce,” adding that staff had to discard thousands of euros worth of perishable stock.
How the attack unfolded
According to initial reports, the attackers targeted the internet-connected controllers that regulate temperature in commercial refrigeration units. By locking operators out of the systems, they forced temperatures to rise, accelerating spoilage. The breach appears to have exploited known vulnerabilities in devices that are often left exposed to the internet without adequate security.
This is not an isolated incident. Similar attacks have been reported in other European countries, including France and Germany, where supermarkets have also suffered from compromised cooling systems. The pattern suggests a coordinated campaign or a widely available exploit, though investigators have not yet attributed the attacks to any specific group.
The Belgian federal police’s cybercrime unit is working with the country’s Centre for Cybersecurity Belgium to trace the origin of the intrusion. Early indications point to a ransomware-style operation, but no ransom demand has been made public so far.
Why supermarket fridges are vulnerable
Security experts have long warned that commercial refrigeration units are a weak link in retail cybersecurity. Many are connected to the internet for remote monitoring and maintenance, but they often lack basic protections such as strong passwords or regular firmware updates. This makes them an attractive target for attackers looking to cause physical disruption.
“The attack on Belgian supermarkets is a textbook example of how cyber threats can have real-world consequences,” said Dr. Lena Fischer, a cybersecurity researcher at the Technical University of Munich. “Retailers need to treat these systems as critical infrastructure, not just as internet-of-things gadgets.”
The financial impact is significant. Preliminary estimates suggest that the affected Belgian stores have lost around €100,000 in spoiled goods, a figure that could rise as more outlets report their losses. Insurance claims are likely to follow, but many policies may not cover cyber-related damage to physical assets.
Broader European concerns
The incident has reignited debates about the security of critical infrastructure across Europe. In recent months, Norway has reported a tripling of successful cyberattacks in just six months, and Belgium’s tax portal MyMinfin was also taken offline after a separate attack on the FOD Financiën. These cases highlight a growing trend of cybercriminals targeting essential services.
European Union officials have called for stronger cybersecurity standards for retail and food supply chains. The proposed Cyber Resilience Act, currently under negotiation in Brussels, would require manufacturers of connected devices to meet minimum security requirements before they can be sold in the EU. If adopted, it could force supermarkets to upgrade their refrigeration systems to more secure models.
For now, Belgian retailers are scrambling to restore normal operations. Some have brought in mobile cooling units, while others are relying on backup generators to keep remaining stock at safe temperatures. The empty fridges serve as a stark reminder that cyberattacks are no longer just a digital nuisance—they can empty the shelves of a supermarket in a matter of hours.
As one shopper in Brussels put it, “You don’t think about hackers when you buy milk, but now I’m checking the dates on everything.”
