Cold Chain, Hot Target: Supermarket Fridge Attacks Reach Estonia

Baltic Security Monitor | Material Update
Security Watch: 2 November 2026, 14:00 EET · Materiality: MODERATE · Domain: cyber / operational technology / food-supply resilience

Overnight into 2 November, unknown attackers remotely took over supermarket refrigeration in Sweden, Belgium, Luxembourg and Estonia. In one Estonian store, a refrigerated display case was set to 50°C. Two weeks ago, Estonian experts warned that the French scenario could happen here. It just did.

What happened in Estonia

On the morning of 2 November, attackers gained access to the remote-management computer of a refrigeration system at a store belonging to a large Estonian grocery chain and set a display case to 50°C. The chain has not been named. The incident was disclosed by Jann Mutso, head of Kitman Coldtech, a refrigeration equipment maker and distributor.

The intrusion was stopped within about ten minutes, so no damage was done. Mutso said the entry point was an outdated Danfoss controller and that older, unpatched controllers are precisely what is being targeted. He added that other Kitman clients in Estonia were also hit, though the full scale is not yet known. He described the signature as the same as in October's incidents in France and the Netherlands.

Sweden, Belgium, Luxembourg

The same night, similar incidents hit other countries. In Sweden, ICA and Coop stores were affected. At one ICA store in Stockholm the attack struck at 2 a.m. and was only noticed at 5:30 a.m.; Coop said six of its stores were hit. Staff were seen throwing out carts of spoiled food. Sweden's national cybersecurity centre is handling several incidents nationwide, and its head, John Billow, acknowledged that the country has a lot of exposed operational technology devices that need updating or patching.

In Belgium and Luxembourg, Ahold Delhaize and Colruyt reported an overnight incident affecting fridges and freezers in dozens of stores. Colruyt confirmed that five Spar shops were attacked. The head of Sabcobel, which runs Delhaize's refrigeration systems, told the Belga news agency that the units' evaporators had been switched into defrost mode, the same technique used in France.

The October precedent

In October, according to French police, hackers seized control of cooling units at hundreds of French supermarkets and pushed temperatures up to 50°C, causing food losses and even fires. Nobody has claimed responsibility, and there is no attribution.

After the French attack, ERR asked Estonian experts whether it could happen here. TalTech analyst Toomas Lepik called the threat very real. Justice and Digital Affairs Minister Liisa Pakosta noted that strict cybersecurity rules apply to providers of vital services, but they do not cover every grocery store.

BSM analysis

This is not another data breach. It is an attack with a physical effect. A digital command changes a temperature, and the temperature spoils food, creates food-safety risks and can start a fire. The target is well chosen: thousands of poorly protected controllers, put online for convenient maintenance, none of them treated as critical infrastructure.

The Estonian case shows both a weakness and a strength. The weakness is the regulatory gap that Pakosta herself pointed to: food retail is only partly covered by strict requirements. The strength is a supplier that reacted fast. At one Stockholm store the attack went unnoticed for three and a half hours; in Estonia it was stopped in ten minutes. That gap decides whether an incident becomes a news item or a skip full of spoiled food.

Who is behind the attacks is unknown. The shared technique and the simultaneous timing across several countries point to a single campaign or a single tool, but there is no evidence yet of a common perpetrator. Blaming Russia at this stage would be premature.

Why it matters for regional security

The Baltic and Nordic states are building crisis resilience, and food supply is part of it. An attack on the cold chain will not stop an army, but it can create local shortages overnight, destroy stocks and spread anxiety. It belongs to the same class of threat as the hacking of warning apps a day earlier: a strike on infrastructure people take for granted, without a single shot fired.

What to watch

Which Estonian chain was hit and how many stores were affected. Whether CERT-EE and Sweden's cybersecurity centre confirm shared technical indicators with the French incidents. Official damage estimates. Whether Estonia extends cybersecurity requirements to the whole food retail sector.

Bottom line

Two weeks ago the French attack looked exotic. Now it has reached Estonia, Sweden and the Benelux in a single night. An outdated controller in a supermarket's back room has turned out to be part of the security perimeter, and it will have to be protected just like a server.

Baltic Security Monitor (osint-baltic.com) — an analytical publication on security on NATO's northeastern flank.
Based on automated open-source monitoring with independent verification of key facts.