Europe Supermarket Fridge Cyberattacks: Who Is Behind Them?

Supermarket refrigeration systems across Europe have become the target of a series of apparent cyberattacks, with hackers remotely changing thermostat settings and causing fridges and freezers to overheat. The incidents have affected retailers in seven European countries, raising concerns about food security, supply-chain disruption and the vulnerability of internet-connected appliances.

In some cases, temperatures reportedly climbed as high as 50C (122F), putting stored food at risk and forcing retailers to deal with potential losses. The European Union condemned the incidents as “a deliberate attempt to disrupt our Food Supply Chain and undermine consumers’ confidence in it”.

Investigators have not identified those responsible. Cybersecurity experts have suggested that the attacks could involve a state-linked operation designed to demonstrate technical capabilities or an individual hacker acting for personal reasons.

Which supermarkets were affected and what does it mean?

The latest wave of incidents affected refrigeration systems at supermarket and retail locations across seven European countries. Reported affected businesses included:

• Belgium: Carrefour, Intermarché and Ikea.
• Sweden: Coop and ICA.
• Luxembourg: Delhaize.
• Finland: Kesko.
• Ireland: SupaValu.
• Estonia: Shops and retail locations were also affected.

The incidents appeared to repeat an earlier wave of attacks in France, where retailers reportedly had to discard large quantities of food after hackers gained control of internet-exposed appliance management software and caused refrigeration units to overheat.

A similar series of unexplained refrigeration failures was reported in the United States in early August, affecting commissaries at several military bases. The Pentagon was investigating a suspected cyberattack.

The incidents have raised concerns that cyberattacks could increasingly target everyday infrastructure rather than conventional computer networks. Commercial refrigeration systems are particularly important to Supermarkets because temperature failures can quickly threaten perishable food stocks.

Internet-connected appliances are not limited to refrigerators. Ovens, washing machines, dishwashers and central heating systems can also be remotely accessed or controlled. If their management systems are poorly secured, they may provide attackers with another route to disrupt businesses and essential services.

Who is behind the supermarket fridge cyberattacks?

No politically motivated hacktivist group has publicly claimed responsibility for the incidents. There has also been no reported ransomware demand asking supermarkets to pay money to stop the disruption.

Rafe Pilling, senior director for threat intelligence at cybersecurity company Sophos, identified two possible explanations: a state-linked actor demonstrating its capabilities or an individual hacker carrying out attacks for personal reasons.

“The two most plausible attribution scenarios for me are some kind of state-based signalling and demonstration of capability or some kind of lone-wolf hacker that is conducting these attacks for their own personal reasons,” Pilling said.

The possibility of state involvement has attracted attention because disrupting supermarket refrigeration can have consequences beyond the affected businesses. Large-scale food losses and empty shelves could create public anxiety and undermine confidence in supply chains.

Hackers linked to Russia and China are among the possible actors being considered in the broader discussion of state-backed cyber operations. However, no evidence provided so far establishes that either country was responsible for the supermarket incidents.

Western intelligence officials have warned that Russia has conducted a range of alleged sabotage activities across Europe. Such warnings have contributed to concerns that attacks on commercial infrastructure could form part of wider efforts to create disruption and uncertainty.

Attributing the fridge attacks is particularly difficult because the apparent method did not require conventional malware. Sophos’s Pilling compared the technique to “wearing rubber gloves and messing with the switches”, suggesting that attackers may simply have accessed exposed controls and changed settings.

How were hackers able to control supermarket refrigerators?

Commercial refrigeration systems increasingly use internet-connected software to monitor temperatures, manage equipment and allow remote maintenance. These features can help retailers operate large refrigeration networks, but they can also create security risks when systems are accessible from the internet without adequate protection.

If attackers gain access to the management software, they may be able to alter settings remotely. In the reported incidents, changing thermostat controls was enough to cause refrigeration units to overheat, potentially damaging food stored inside.

One major problem is that software installed in industrial appliances may not receive updates as frequently as operating systems on computers and smartphones. Users of personal devices often receive notifications when security patches are available, but commercial equipment can remain on older software for extended periods.

Nick Jackson, director of cyber-operations at cybersecurity company Bitdefender, said installing updates can be difficult because the process may require machinery to be taken offline. For supermarkets, that can create operational problems if refrigeration systems need to remain available throughout the day.

Jackson also suggested that a lack of awareness could be a simpler explanation for delays. Staff responsible for operating refrigeration equipment may not always recognise cybersecurity as a priority.

The latest incidents also highlighted the risks associated with network connections. Coop in Sweden said some of its refrigeration units were connected through a 4G mobile network, potentially increasing their exposure. ICA said its system was supplied by Danish company Danfoss, which had also experienced problems in France.

What can supermarkets do to protect fridges and freezers?

Cybersecurity specialists have identified software updates and security patches as important steps in protecting commercial refrigeration systems. Retailers need to ensure that internet-connected equipment is running supported software and that known vulnerabilities are addressed.

The Belgian refrigeration group Sabcobel said the impact of the latest incidents could have been considerably worse if it had not begun patching refrigeration systems following the October 12 attack in France.

Retailers can also reduce exposure by reviewing which systems are accessible remotely, securing network connections and restricting access to equipment management controls. Monitoring unusual temperature changes and unexpected system activity can help businesses identify problems before they lead to widespread food losses.

In the United Kingdom, retailers were reportedly working with the National Cyber Security Centre (NCSC) to strengthen the security of refrigeration equipment. Graham Wynn, assistant director of regulatory affairs at the British Retail Consortium, said retailers were working to ensure their fridges and freezers were as secure as possible against potential attacks.

Why have British supermarkets not been affected yet?

British supermarkets had not been reported among the retailers affected by the latest incidents. However, cybersecurity experts have warned that the absence of reported attacks does not mean the country’s refrigeration systems are immune.

According to cybersecurity company Forescout, internet-exposed refrigeration systems are more commonly found in countries including France, Italy, Greece and Belgium.

Daniel dos Santos, Forescout’s vice president of research, said the United Kingdom was not among the top 10 countries with the largest number of exposed supermarket refrigeration systems identified in the company’s data.

He described the risk in the UK as not negligible, while adding that it was not particularly high compared with countries where more exposed systems had been identified.

A spokesperson for the NCSC said the organisation was “working with its international partners and industry to fully understand details of an incident”.

Could supermarket refrigeration become a new target for cyberattacks?

The incidents demonstrate how internet-connected industrial equipment can become a target for cybercriminals and potentially state-linked actors. While attacks on computers and corporate networks are well established, remotely changing the controls of refrigeration systems shows how digital access can cause physical and commercial disruption.

For supermarkets, the consequences can include food waste, financial losses and interruptions to normal operations. If attacks spread across multiple retailers or countries, they could also place pressure on parts of the food supply chain.

Investigators have yet to establish who carried out the attacks or whether the incidents were coordinated. Until responsibility and the full method are confirmed, the possibility of further disruption remains a concern for retailers operating internet-connected refrigeration systems.