Hackers changed refrigeration settings at European supermarkets, forcing stores to discard produce, while UK suppliers reported attacks on cold-storage systems.
Supermarkets are reviewing their refrigeration security after cyberattacks on November 2 altered cooling settings and forced stores to discard chilled and frozen food. Reports initially covered seven European countries, but later disclosures added Germany and identified affected food businesses in the UK.
By November 3, some retailers had restored operations while disconnecting refrigeration controllers from the internet. Others were checking equipment installed outside their centrally managed networks, where individual stores and contractors handle remote access.
Refrigeration Controls Switched to Defrost
At an ICA Kvantum store in Sjöbo, southern Sweden, employees found refrigeration controls set to 50°C (122°F). Another ICA store in Stockholm reported a similar incident and said food had been destroyed. These reports describe altered settings, rather than independently verified temperatures throughout the stored products.
Belgian refrigeration company Sabcobel said attackers switched evaporators into defrost mode, causing equipment to warm up. Chief executive Stephan Moelans told local media that technicians worked through the night to disconnect affected installations. He said some systems required physical modifications and secured connections, rather than a software update alone.
Disruptions also affected several dozen Delhaize stores in Belgium and Luxembourg, alongside 15 Carrefour locations in Belgium. In Ireland, Musgrave Group said refrigeration systems at 13 SuperValu stores were affected. Staff removed products as a precaution, and restocking began after the incident was resolved.
UK Suppliers Report Altered Controls and Disabled Alerts
The incidents were not confined to supermarkets. The Association of Independent Meat Suppliers said three UK abattoirs had been affected, while the National Cyber Security Centre confirmed it was assisting organisations involved.
London fruit and vegetable wholesaler Langridge Organic told The Grocer that attackers altered six of its ten cold-room controllers. They also disabled automated messages intended to warn staff when temperatures moved outside the required range.
Staff detected the changes through manual temperature checks and disconnected the equipment’s internet connection. The company reported no stock losses. Copeland, whose Dixell XWEB controls were identified in the reported UK cases, said it was assessing the circumstances and had circulated patching and security guidance to customers.
Retailers Disconnect Equipment as Stores Recover
Sweden’s ICA subsequently identified 23 affected stores, saying their refrigeration equipment was connected outside its centrally managed network. Coop said seven affected stores were operating again, with their cooling systems disconnected from the internet during a wider security review.
Reuters also identified an affected Edeka store in Reisbach, Germany. Danfoss said its equipment was among the systems targeted and advised customers against exposing refrigeration controls directly to the internet. British officials described the domestic impact as minimal, while maintaining heightened alert.
Earlier Attacks Hit French Supermarkets
The November incidents follow attacks reported in France on October 12, when remotely altered refrigeration systems caused food losses at hundreds of stores. Reports also described fires in some locations.
France’s CERT-FR identified compromised Danfoss AK-SM and AK-SC controllers, alongside Copeland and Dixell XWEB systems. Its advisory recommends removing public internet access, checking configurations, updating firmware and changing default passwords. Remote maintenance should operate through a secured VPN or protected network.
The agency also warned that resetting an unsupported controller does not fix its underlying weaknesses. Reconnecting vulnerable equipment to the public internet leaves it exposed to another compromise. Authorities have not publicly identified the perpetrators or established a common attacker behind the reported incidents.
The exposure had already been documented before the November attacks. As Hackread.com reported on October 26, Forescout’s Vedere Labs identified 12,976 internet-exposed refrigeration services on 6,017 public IP addresses in 99 countries and territories. These were service observations, not a count of individual refrigerators.
Researchers warned that access to exposed management interfaces could allow attackers to change temperatures, defrost schedules or alarm settings, putting food, medicines and other temperature-sensitive supplies at risk.
Experts Question Who Owns Refrigeration Security
Commenting to Hackread.com, Waseem Ahmed, Head of Engineering at Secure.com, pointed to remotely accessible controllers and ageing equipment, while cautioning against attributing every incident to the same cause.
“If these are cyber-attacks, as suspected, the common thread looks like remotely reachable controllers, not a fridge fault. French authorities named specific refrigeration controllers, researchers found thousands reachable from the internet, and one expert said many ran default passwords. Some older models no longer get security updates. The latest wave is still being confirmed, so I wouldn’t point at one vendor or one flaw today…”
Joshua Marpet, Senior Product Security Consultant at Finite State, said businesses should prepare for further disruption by identifying the equipment essential to their operations.
“In the wake of at least two waves of successful attacks against the infrastructure supporting food distribution, we have to assume that there will be others…That being said, this is not a moment to panic. This is a moment to reassess. And a moment to prepare. This is the moment we examine all of the devices in our infrastructure and determine which we prioritize as essential or not.”
Sweden’s official crisis-information service said there were no specific recommendations for the public. Its guidance instead directs businesses to review the security of the operational technology controlling refrigeration and other critical functions.
(Photo by Pexels)
