Sweden Issues Cyberattack Warning After Supermarket Freezer Hacks

Executive Summary

Sweden’s government issued a cyberattack warning on 10 November 2026, saying more incidents are likely in the coming months after attackers remotely raised temperatures in refrigeration systems at Swedish grocery stores on 2 November. Minister for Civil Defence Carl-Oskar Bohlin and John Billow, head of the National Cyber Security Centre (NCSC), told a press briefing in Stockholm that Russia has become more willing to take risks. NCSC said the store attacks mainly hit older systems from one manufacturer with weak passwords. France attributed its October wave of refrigeration attacks to a unit of Iran’s Revolutionary Guard on 9 November. Sweden has named no one.

Exposed Devices and Faster Exploits Behind the Warning

The slides shown at the briefing set out the case for the cyberattack warning. They say Russia has tried destructive cyberattacks against several countries including Sweden. AI is finding security holes much faster and known vulnerabilities have nearly doubled in a year. Flaws are now exploited within days of becoming known. Bohlin said China and Iran are also targeting systems that control electricity, water and heating.

“There is a risk that we will see more cyber incidents in the coming months,” Bohlin said.

NCSC’s own slide is blunter. Several thousand vulnerable devices in Sweden are exposed to the internet, more than in any other Nordic country. The centre says it sent targeted warnings before the store attacks and supports victims through CERT-SE, its incident response team. Billow said several grocers heeded NCSC’s call to upgrade after the French attacks in October but not all did.

Billow also pointed to the Cybersecurity Act (cybersäkerhetslagen), Sweden’s NIS2 implementation, in force since January 2026. Its roughly 3,500 covered operators of essential services now face “sharp and detailed requirements”, he said.

At an earlier briefing on 15 April 2026, Bohlin said a pro-Russian group linked to Russian security services had failed to disrupt a heating plant in western Sweden.

What Hit Swedish Stores on 2 November

Coop’s press chief Carlos Cancino said seven of the chain’s 800 Swedish stores were hit, six in the Gävle area and one in Sundsvall. ICA Sverige said a small number of stores connected outside its central network were affected without giving a figure.

An ICA spokesperson has said the affected stores were linked to an external refrigeration control system from Danfoss, the Danish manufacturer. Coop said some of its stores had recognised the same equipment used in France.

Researchers at the French security company Sekoia ran four decoy Danfoss AK-SM 800A interfaces from 12 October. The AK-SM 800A is a system manager that supervises a store’s refrigeration controllers. The decoys logged password-spraying against admin accounts with “12345”. Sekoia’s only confirmed exploitation attempt came on the night of 1 November and tried to rename an administrator account without logging in.

CERT-SE said on 2 November it was in ongoing contact with affected parties. Fredrik Nilsson of Police Region South, which coordinates the investigation, expects more than the roughly ten police reports filed so far.

France Names an Iranian Unit but Sweden Names No One

On 9 November France’s CERT-FR published a report from the national cyber crisis coordination centre attributing the 11 to 12 October attack on refrigeration controllers at about 700 French sites to Shahid Kaveh. Sekoia says the unit, part of the Cyber-Electronic Command of Iran’s Islamic Revolutionary Guard Corps (IRGC), is best known as CyberAv3ngers. Paris prosecutors have opened an investigation into its leader and two deputies.

The Swedish briefing slides name no actor.

The French attribution covers only the October wave. Sekoia thinks both waves may share an actor. Pro-Russian groups NoName057(16) and Z-Pentest have claimed involvement; Sekoia called the claim unsubstantiated. ICA hasn’t said how many of its stores were hit. No Swedish authority has said how the attackers got in or what the discarded food cost. The EU joint statement relayed by CERT-SE on 6 November says affected member states are still investigating.

A Booked Upgrade That Came Too Late

After the French attacks Coop’s Gävle-area stores identified the same equipment and booked an upgrade for Wednesday 4 November. The attack came in the night to 2 November. “Early analyses indicate that if we had managed to do the updates at these seven affected stores they would not have been hit,” Cancino said (translated). NCSC’s cyberattack warnings had already gone out. The fix was two days away.

References

1. Presentationsbilder från pressbriefing den 10 november 2026 om läget på cyberområdet
2. Cyberangrepp mot uppkopplade frys- och kylsystem
3. EU varnar för cyberincidenter i kyl- och fryssystem
4. Activités cyber offensives ciblant la France menées par des acteurs iraniens liés au CGRI
5. The cold chain on fire: Unpatched Danfoss controllers exploited
6. Regeringen vidtar åtgärder för att skydda operativa system från cyberhot

This post is also available in: