Supermarkets in at least five European countries lost refrigeration on Monday in what investigators suspect is the second coordinated cyberattack on store cooling systems in under two months. Ahold Delhaize confirmed an IT incident pushed temperatures up in refrigeration systems across dozens of its supermarkets in Belgium and Luxembourg, The Guardian reported.

Grocers in Sweden, Estonia and Ireland reported similar failures the same day. That pattern matters. It mirrors an October attack in France, where hackers seized control of cooling equipment in as many as 700 supermarkets, according to French police cited by The Guardian.

What did the attackers actually do?

The mechanism was simple and, for food retailers, brutal. Stephan Moelans, CEO of refrigeration firm Sabcobel, said the attack switched the units' evaporators into defrost mode, according to Al Jazeera. A continuous defrost cycle is effectively a hostile off-switch for cold storage.

Moelans said technicians were called out from 1 a.m. onward to physically cut the compromised installations off from grid power, according to The Guardian. In other words, the fix was manual. You unplug the machine.

An Ahold Delhaize spokesperson, Sarah De Meester, said the company is investigating the temperature increases, The Guardian reported.

In France, the same technique drove refrigerator and freezer temperatures up to 50 degrees Celsius — 122 Fahrenheit — at Intermarché, Coopérative U and Leclerc stores. At those levels, stock spoils within hours. Jann Mutso, CEO of technology supplier Kitman Coldtech, said at least one Estonian grocery chain was hit on Monday too, with temperatures again pushed to 50 degrees Celsius, Al Jazeera reported.

How many stores were hit this time?

The confirmed tally, by retailer:

• Ahold Delhaize: dozens of supermarkets in Belgium and Luxembourg affected by the IT incident.
• Colruyt Group: refrigeration equipment in five Spar shops targeted. Colruyt franchises out the Spar outlets it oversees across Belgium, a spokesperson told Reuters.
• Coop (Sweden): six stores affected.
• ICA (Sweden): a small number of outlets had cooling and freezing equipment knocked offline.
• Axfood (Sweden): hackers broke into freezers at a Gothenburg-area hub that handles home-delivery orders, according to Al Jazeera.
• SuperValu (Ireland): a "cyber incident" compromised one particular type of refrigeration unit in 13 of the chain's 223 stores.

Why were these systems so exposed?

The answer, at least in Sweden, comes from the top of its cybersecurity apparatus. John Billow, head of Sweden's national cybersecurity center, said the agency is handling several incidents tied to cooling equipment in stores, Al Jazeera reported.

Billow's diagnosis is blunt: Sweden has many exposed operational technology devices — the dedicated hardware that runs physical machinery, as opposed to office IT — that still need updates or patches. Refrigeration controllers are exactly that kind of device. They sit on networks, they run old software, and few grocery executives thought of them as an attack surface until now.

The French case sharpened the picture. Hackers there took over control units that came largely from Danfoss, a Danish company. If a single vendor's controllers sit inside thousands of stores across Europe, one exploitable weakness scales across borders.

There may be a thread connecting the waves. Ahold Delhaize notified Dutch police last month of a cybersecurity incident, The Guardian reported — a disclosure that now reads as a possible early signal of the campaign.

Who is behind it?

No one knows, publicly at least. No group has claimed responsibility for Monday's incidents or for the October attack in France, Al Jazeera reported.

That silence leaves retailers with the uncomfortable part. The attacks demonstrate that low-profile industrial kit — freezer controllers, evaporator regulators — can be turned into an instrument of spoilage and loss without touching a single payment system or customer database. For chains running hundreds of stores, the operational technology layer just moved from background infrastructure to board-level risk.