Suspected Cyberattacks Push Supermarket Fridges to 50C Across Europe
Supermarket chains in Belgium, Sweden, Luxembourg and Estonia have reported sudden changes to fridge and freezer temperatures, in a new wave of suspected cyberattacks. Local reports, shared by Bloomberg and Reuters, describe the same pattern across several countries.
In Sweden, an Ica Kvantum store said on its Facebook page that its fridges and freezers had been hacked overnight. The store reported that temperatures had been remotely raised to 50 degrees Celsius (122 Fahrenheit). Swedish chain Coop confirmed that unauthorized actors accessed and tampered with cooling systems at a small fraction of its stores.
The Dutch retailer Ahold Delhaize said an IT incident had adjusted the temperature of refrigeration units in dozens of its supermarkets in Belgium and Luxembourg. Lecho reported that about 100 Belgian supermarkets had their refrigeration systems hacked. The Telegraph reported at least 70 stores targeted across Belgium, Sweden, Ireland, Luxembourg and Estonia.
The current wave follows a French campaign in October. Reuters reported on 12 October that the Intermarché cyberattack targeted 150 stores, and that hackers raised refrigerator and freezer temperatures at French supermarkets to as high as 50 degrees Celsius (122 Fahrenheit). Bloomberg reported that the attacks accessed cooling systems and set them to defrost, and that units heated to 50C for around six hours. The attack on hundreds of stores took place overnight from Sunday to Monday, according to RTBF. BFM Télévision reported that hundreds of Intermarché and Super U stores had fresh products destroyed, and that Leclerc stores were among those whose fridges were hit. Reuters reported that the French attacks sparked fires. The Verge put the resulting food spoilage at millions of euros, based on estimates.
Denmark's Danfoss was caught up in the case, according to Bloomberg. As of 13 October, Reuters reported that no group had claimed responsibility for the French fridge hacks.
Separately, the Pentagon was treating freezer malfunctions at military bases as a suspected cyberattack as of 29 October, according to Reuters.
The broader context here is a common thread. The French and Belgian incidents both involved refrigeration controllers, the small computers that hold a cabinet at its target temperature, and those controllers could be adjusted from outside the store. The temperature change is the visible symptom. The set-point, the target the controller tries to hold, is what the attacker altered.
In my view, the more instructive point is how ordinary these systems are. Cold-chain controllers, the equipment that keeps food refrigerated from supplier to shelf, along with building management gateways and temperature loggers, are networked devices, often managed by third-party integrators. They sit in the same environments as point-of-sale and payment equipment. Changing a set-point is cheap to do and expensive to clean up, because the consequence is spoiled stock, not a data breach.
The defensive measures are ones that operational technology (OT) teams already know. They include network segmentation, which separates refrigeration controllers from corporate IT so a compromise in one cannot easily reach the other. They also include strict authentication for remote maintenance access, and monitoring that alerts on temperature deviations independently of the controller itself. Cloud-based telemetry lets a chain watch hundreds of cabinets from one dashboard, and that same reach means a single compromised channel can touch many sites. The connectivity that lets a store catch a failing compressor before stock is lost is the connectivity an attacker wants. Chains that treat cold-chain networks as a distinct security zone, rather than an appliance subnet, are better placed to keep the benefits while limiting what a compromise can reach.
