Cyberattacks hit European grocers: *the freezer hijack* and what it says about control

What happened

In early October 2026, two separate cyberattacks hit grocery retailers in Europe. In France, attackers broke into the control systems of several supermarkets and remotely hijacked their freezers and chillers, forcing the temperatures up ^[1]. The result was straightforward: chilled and frozen products were destroyed, and the shops had to throw them away.

Around the same time, Ahold Delhaize reported that stores in the Netherlands and Belgium had suffered operational disruption from a security incident, without giving further details ^[2]. The two incidents appear unrelated, but together they show how vulnerable everyday infrastructure has become.

Freezer hijacking is less a heist and more vandalism at industrial scale. Think of it as someone breaking into your house, not to steal anything, but to turn the thermostat up to 30 degrees and ruin everything in the fridge. The difference is that a supermarket's losses run to tens of thousands of euros per store, and the attacker never has to set foot inside.

The evidence question

Both incidents raise a question that matters more than the technical details: when did the retailer know something was wrong, and when did it report it?

Under Sweden's Cybersecurity Act, which implements the EU's NIS2 directive, essential and important entities across 18 sectors must report significant incidents in stages ^[3]. An early warning goes to the supervisory authority within 24 hours of becoming aware of the incident. A full incident notification follows within 72 hours, and a final report within a month.

The clock starts when you became aware, not when it was convenient. That's like the duty to report a lost bank card: the 24 hours begin the moment you notice it's missing, whether that's at breakfast or three in the morning.

If a supervisor later asks why the early warning went out after 30 hours instead of 24, the organisation needs to show when it first knew. Logs matter, but a log its own IT team could have edited is easier to challenge than one with an independent record.

Where logs fall short

Logs tell you what happened during an incident: which systems were accessed, when temperatures spiked, who was alerted. They're essential. The trouble is that logs are kept by the same people who could change them.

Say an IT administrator spots unusual activity at 14:23 on a Tuesday and writes it to the incident log. A day later, someone realises the early warning should have gone out sooner and wonders whether the log could be adjusted to show the detection happened later. With administrator rights, that's technically possible.

It rarely happens, and most organisations would never dream of it, but the possibility is enough to weaken the log's evidential value. In a regulatory review or an insurance dispute, the other side can ask: how do we know this log is the one written on the day?

Access controls and monitoring are the foundation. A digital witness adds a layer that works even when someone with the right access changes something.

Sealing an incident timeline

Here, the thing to seal is each step of the incident as it happens: the first detection note, the decision to escalate, the early warning as it is sent and each subsequent report.

Sealing means taking a fingerprint of the record and sending it to WitniumChain through the REST API, the SDK or the MCP server. The content never leaves your systems. You get a witness ID back, and that ID is a permanent receipt.

When a supervisor or an auditor later wants to check, anyone you share the record with can calculate the fingerprint again and compare it with the sealed one. If the record has changed, even by a single character, the fingerprints won't match. If it hasn't, they will, and nobody has to take your word for it.

What it shows is when each step was recorded, in a way nobody can quietly rewrite afterwards. What it doesn't show is that the report was complete, that the response was adequate or that the incident was handled well. Those are separate questions.

The first 2,000 witnesses a month are free.

How it would work

1. At each step of the incident response, your system sends a fingerprint of the note or report to WitniumChain and gets a witness ID.
2. The fingerprint is sealed on a chain where any later change would show, even one made by us.
3. When a supervisor asks for the timeline, you share the records and the witness IDs. They calculate the fingerprints again and check.

What this means for you

If you're responsible for cybersecurity or incident response in a sector covered by the Cybersecurity Act, here are three questions worth asking now:

• Could we show a supervisor exactly when we first became aware of an incident, using a record nobody could have quietly changed afterwards?
• Do we have a documented process for meeting the 24-hour, 72-hour and one-month deadlines, with timestamps we can rely on?
• If our incident logs were challenged, whose word would a court or a supervisor have to take?

The freezer hijack in France is unusual in its method, but the underlying question is ordinary: when you knew, what you did and how you can show it. The regulations assume you can answer that. A digital witness makes it checkable.

What to watch

Sweden's Cybersecurity Act has applied since 15 January 2026, with reporting deadlines already in force ^[3]. The EU's Cyber Resilience Act, which covers connected hardware and software, requires manufacturers to report actively exploited vulnerabilities and serious incidents through ENISA's common platform, with similarly tight deadlines, from 11 September 2026 ^[4].

The pattern is the same: know quickly, report quickly, and be able to show what you knew and when. That last part is where logs become evidence, and evidence needs to be defensible.