Russian Hackers Turned Swedish Supermarket Freezers Up to 50 Degrees

STOCKHOLM - Hackers broke into the cooling systems of Swedish supermarkets in the middle of the night and turned the freezers up to 50 degrees Celsius. Shops had to throw away their entire stock of frozen food. Now pro-Russian hacker groups are claiming responsibility.

The attacks hit grocery stores across Europe during the night to Monday. Among the victims were Sweden's two biggest grocery chains, ICA and Coop.

Coop said six of its roughly 800 stores were affected. ICA first spoke of "a limited number" of stores, but it later emerged that 23 of its shops had been hit.

At the ICA Baronen store in Stockholm, every freezer was pushed to 50 degrees. Sales manager Engla Ingwall told the local paper Mitt i Stockholm that the attack happened at around two in the morning, but staff only discovered it hours later.

"We had to throw everything out," she said.

Pro-Russian groups claim the attack

The pro-Russian hacker groups NoName057(16) and Z-Pentest Alliance have both claimed responsibility for the attacks on European grocery stores.

NoName057(16) also posted what it called proof of the break-in: a list of more than 2,500 lines that it said contained usernames and passwords belonging to staff and customers of the Danish refrigeration company Danfoss.

Z-Pentest Alliance used the moment to mock European and American operators, claiming that poor cybersecurity had left their systems wide open.

The claims were first posted on the groups' Telegram channels, which have since been deleted. According to the cybersecurity site Cybernews, that means they can no longer be independently verified.

Who the hackers are

NoName057(16) was formed in March 2022, shortly after Russia invaded Ukraine. It has carried out a string of denial-of-service attacks on government agencies, banks and media outlets in the West.

Z-Pentest Alliance appeared in late 2024 and is said to have links to former members of NoName057(16) and the Cyber Army of Russia Reborn. It mainly targets industrial control systems in energy, water supply and food production.

The name points to the letter "Z", which was painted in large white letters on Russian tanks and military vehicles when the invasion began in February 2022 and has since become a symbol for supporters of the war.

Chains scramble to plug the holes

Coop has now disconnected the affected cooling systems from the internet and is replacing old 4G connections with newer 5G technology.

ICA has also launched a security review. All 23 affected stores had equipment that was connected outside the chain's own store network.

By Tuesday, Swedish police had received around ten reports linked to the attacks and expected more to follow.