Sweden's supermarket freezer attacks: what the *evidence question* is

When the frozen peas thaw

A refrigerator is just a box with a motor until someone opens the door and everything's spoiled. Connected refrigeration systems in supermarkets keep thousands of products at the right temperature, log it all and alert someone when something goes wrong. When those systems are attacked, the logs are what tell you what happened and when you knew about it. The question is whether anyone can trust them.

The EU Commission has opened an investigation into cyberattacks on connected fridges and freezers in Swedish supermarkets ^[1]. The incidents affected critical refrigeration infrastructure and are part of a cross-border investigation. Computer Sweden reported the investigation on 8 January 2025, citing sources familiar with the matter.

For supermarket chains, the evidence question isn't whether the attack happened — spoiled stock and failed compressors make that clear enough. The question is what the logs show, when the chain knew, what it reported and whether the logs themselves can be challenged later.

What Sweden's law requires

Sweden's Cybersecurity Act came into force on 15 January 2026, implementing the EU's NIS2 directive ^[2]. Supermarket chains operating critical refrigeration infrastructure are likely to be covered as essential or important entities.

The law requires risk management and incident reporting in three stages: an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours and a final report within one month ^[2]. The clock starts when the organisation knew, not when it was convenient.

That's the bit that matters. Like when you lose your bank card: the moment you notice it's gone is the moment you're expected to report it, not the moment you've finished your shopping.

The Swedish Fortifications Agency (Försvarets materielverk) can impose sanctions for non-compliance, and the timeline is tight enough that most organisations won't have finished their internal investigation before the first deadline hits.

What the Cyber Resilience Act will require

From 11 December 2027, products with digital elements sold in the EU must meet security requirements set out in Annex I of the Cyber Resilience Act ^[3]. Connected refrigeration systems are products with digital elements.

The requirements include the ability to log and monitor security-relevant events. Manufacturers must also report actively exploited vulnerabilities and serious incidents through ENISA's common platform, with an early warning within 24 hours of becoming aware ^[4].

The CRA's reporting duty applies from 11 September 2026, well before the product requirements come in ^[4]. Penalties for non-compliance can reach 15 million euros or 2.5 per cent of global annual turnover, whichever is higher.

The evidence question

When a refrigeration system fails, the logs are what tell you whether it was a cyberattack, a hardware fault or someone leaving a loading bay door open. The logs show temperature readings, compressor cycles, door sensors, network traffic and alerts.

Here's the problem: the logs are kept by the same people who have to report the incident. An auditor, a supervisor or an insurer will ask when the chain knew. If the log shows the first alert at 23:50 on Monday and the early warning went out at 02:00 on Wednesday, that's 26 hours. Close, but over the line.

If the operator could have changed the timestamp on that first alert, the log is easy to challenge. It doesn't matter whether anyone actually did. The question is whether they could have, because the person asking doesn't have to take your word for it.

How a digital witness works here

This is a strong fit for a digital witness. The thing to seal is log segments from the refrigeration system's monitoring platform: temperature readings, alerts, compressor status and network events, sealed at short intervals, say every few minutes.

Sealing takes a fingerprint of each segment, not the data itself, so the logs never leave your systems. The fingerprint is recorded on WitniumChain, where any later change would show, even one made by us. When an auditor or a supervisor asks to see the logs, you share the segment and the witness ID. They calculate the fingerprint again and check it against the sealed one. If it matches, nothing has changed since sealing.

A digital witness doesn't replace access control, monitoring or backups. It doesn't show that the response was adequate or that the report was complete. What it does is let you show that the log segment existed at that time and hasn't been touched since, by anyone.

The difference is this: without a witness, the discussion is whether the log can be trusted. With one, the discussion is what the log says.

You can seal logs through the REST API, the SDK or the MCP server. The content stays with you. The first 2,000 witnesses a month are free.

How it would work

1. The refrigeration monitoring platform writes log segments every few minutes.
2. Each segment is sealed with WitniumChain as it closes, and the witness ID is stored.
3. When the early warning is sent, the log segments leading up to it are sealed as well, creating a timeline nobody can quietly rewrite.

What this means for you

If you run connected systems in a sector covered by the Cybersecurity Act or the Cyber Resilience Act, ask yourself:

• Can we show when our systems first detected an incident, in a way an auditor would accept?
• If someone with administrator rights wanted to change a log entry after the fact, would it show?
• Do our incident response procedures include sealing the logs as part of the timeline, not just afterwards?

The law asks for logs. Whether those logs hold up when someone challenges them is a separate question, and a good one to answer before the incident happens.

What to watch

From 11 December 2027, connected products placed on the EU market must meet the Cyber Resilience Act's security requirements, including logging and monitoring ^[3]. Manufacturers should be working on compliance now, because there's no grace period once the date hits.

For refrigeration systems already in the field, the question is whether they can meet the requirements through updates, or whether they'll need replacing. That's a long lead time for critical infrastructure.

The Commission's investigation into the Swedish supermarket attacks may also produce guidance on what counts as adequate logging and incident response for connected systems in critical sectors. Worth watching, if you run any.