Hackers targeted supermarket refrigeration and freezer systems across at least 11 European countries on Monday, forcing retailers to discard food after temperatures in some units soared to 50C (122F).
The wave of attacks hit grocery chains in Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Romania, Sweden, and Germany, according to reports. The disruption follows a similar incident in France last month that affected hundreds of grocery stores.
Retailers report massive food waste and system failures
In Sweden, the supermarket chain Coop reported that six of its approximately 800 stores experienced issues with refrigeration and freezer units, according to The Local Sweden. He noted that he had not received information confirming this was a cyberattack.
[Shop fridges and freezers across Europe hit by fresh suspected cyber-attack] “Chains in seven countries say cooling unit temperatures rose overnight in incident similar to hack of French shops“https://t.co/PhdOQqMZk3
— https://x.com/norionakatsuji/status/2117413763876020661
Engla Ingwall, a sales manager at an ICA franchise store in Stockholm, told Reuters that the attack occurred at 2 a.m. on Monday but was not noticed for several hours.
In Belgium, Ahold Delhaize and Colruyt Group reported that an “IT incident” impacted dozens of stores in Belgium and Luxembourg, according to reports. Sarah De Meester, a spokesperson for Ahold Delhaize, said the chain identified temperature increases in the cooling systems.
In Estonia, the Selver supermarket was hit when hackers accessed a computer to change a freezer setting to 50 degrees. Jann Mutso, the head of refrigeration technology maker and distributor Kitman Coldtech, told ERR that the attackers had gained access to the control computer of an older Danfoss refrigeration system. However, Mutso noted that in this instance, the response occurred within ten minutes, limiting the temperature rise to two or three degrees and preventing product damage.
European authorities monitor potential supply chain disruption
The European Union has expressed concern that the attacks represent an attempt to disrupt the food supply chain. Christophe Hansen, the EU commissioner for agriculture, stated that these incidents are a deliberate effort to undermine consumer confidence and serve as a warning that must be taken seriously.
Threat actors are turning up the heat on Europe's supermarkets. Literally. Refrigeration systems across Europe have been disrupted, with attackers suspected of manipulating temperature controls through exposed management interfaces. Read the analysis: https://t.co/RLmQzVwJqF
— https://x.com/SentinelOne/status/2117674183274758628
However, Giuseppe Spadaro, director of a group that runs Coop supermarkets in Sicily, said four of his 300 stores were hit, causing thousands of euros in damage and forcing the disposal of stock in those units, Al Jazeera reported.
Vulnerabilities in connected refrigeration technology
Experts suggest the attacks may exploit the fact that many modern refrigeration controllers are connected to the internet for remote monitoring. Jonathan Sogin, a food science researcher at Cornell University, says this made the window to preserve food way shorter than if you were to take something out to defrost it on your counter.
the ai and cyber folks have predicted the progression of this stuff in a way that makes me pretty uncomfortable for what could be next! https://t.co/4swzSHP7dT
— https://x.com/cwarzel/status/2117288443906531695
One potential method involves hijacking the “defrost cycle” of refrigeration units.
Nick Jackson, the director of cyber-operations at Bitdefender, noted that companies sometimes hesitate to install security patches because the process requires machinery to be taken offline, which poses a challenge for food retailers, The Guardian reported.
Rafe Pilling, the senior director for threat intelligence at the cybersecurity company Sophos, suggested two plausible scenarios: a state-based demonstration of capability or a lone-wolf hacker acting for personal reasons, The Guardian reported.
Retailers update hardware to address vulnerabilities
In response to the vulnerabilities, some retailers are moving to update their hardware. The Coop chain in Sweden noted that some of its fridges were linked to a 4G mobile network, which increased their exposure, The Guardian reported. ICA in Sweden indicated its systems were provided by Danfoss, the Danish company that had previously experienced issues in France.
In Germany, the supermarket operator Edeka reported that a store in Reisbach was affected, though the company noted there are no standardized refrigeration systems across its network of independent retailers. The Rewe Büsken supermarket in western Germany also experienced disruption following a cyberattack on system provider Danfoss, though its systems were back in operation by Monday afternoon.
Richard Horne, the chief executive of the National Cyber Security Centre (NCSC), told the BBC that while hackers tried to target small meat-processing firms in the UK, the impact was minimal. He added that the attack is an early sign of increasingly frequent disruptions as old technology fails to keep pace with hackers.
Earlier coverage: Hackers Spike European Supermarket Fridge Temperatures to Destroy Food