Hackers Heat Europe's Supermarket Freezers
Cyberattacks on internet-connected refrigeration controls pushed freezer temperatures as high as 50 degrees Celsius in supermarkets in at least 11 European countries, and the European Union called for immediate action to close the exposed systems.
Freezer cases and grocery aisles in a supermarket, January 2025.Illustration by The Good Times, based on a photo by MatthewHoobin / Wikimedia Commons (CC0)
Hackers took over refrigeration controls in supermarkets across at least 11 European countries, raising freezer and fridge temperatures to as high as 50 degrees Celsius (122 Fahrenheit) and forcing stores to throw out food. Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Sweden, Germany and Romania reported attacks, and Britain's National Cyber Security Centre said a few British firms were hit. The European Commission and ENISA, the EU's cybersecurity agency, said a new wave on November 1 and 2 followed incidents that began October 11, and told companies to act at once to cut exposure. In France, cold-storage units at three or more blood banks were tampered with; the national blood service said no products were damaged and no patients were affected. Investigators say older controllers left reachable from the open internet, including systems made by the Danish company Danfoss, were the way in. No one has claimed the attacks. Romania's top cyber official called them "semi-amateurish" and said he did not suspect a state.
The latest wave of attacks spread over two days. Supermarkets reported refrigeration failures in Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden, and officials and companies then added four stores in Germany and six in Romania. Temperatures in some fridges and freezers rose as high as 50 degrees Celsius.
Belgium was among the hardest hit, with dozens of stores across several chains affected, and federal prosecutors have opened an investigation. In Ireland, 13 SuperValu stores were affected, according to owner Musgrave Group. Seven Intermarché stores in Portugal were affected through what their operator said appeared to be an outside contractor that manages refrigeration. In Italy, about 20 supermarkets were hit, Al Jazeera reported. Giuseppe Spadaro, who runs a group of Coop supermarkets in Sicily, said four of its 300 stores lost their stock. "We had to throw away everything. The shelves are empty," he told Corriere della Sera.
In France, the national blood service said fridges holding blood products at three or more blood banks had their temperature and defrost thresholds set too high. Alarms caught the changes, the products were moved, none was damaged and no patients were affected, it said.
The wave follows an attack in October that hit hundreds of supermarkets in France. Officials and companies point to older refrigeration controllers connected directly to the internet with weak passwords or outdated software. Danfoss, a Danish maker of refrigeration controls whose systems were again among those targeted, recommended that they not be reachable from the internet. The Rewe Büsken store in western Germany lost refrigeration after an attack on Danfoss systems, the company said. Sweden's Coop said affected units at seven stores ran on old 4G connections and that it was speeding up a move to newer networks and modems.
Italy's government met intelligence chiefs and said the businesses affected mostly had "obsolete security systems, with interfaces directly exposed to the internet." Britain's National Cyber Security Centre told retailers to update the software on fridge temperature controls. Its head, Richard Horne, said the risk ran "through the whole food supply chain."
The European Commission, ENISA, Europol's cybercrime center and the networks of national cyber response teams issued a joint statement saying the incidents began October 11 and that a new wave hit on November 1 and 2. Given "the large-scale nature of these incidents," they said, coordinated response at the European level is essential, and they advised organizations "to take immediate action to mitigate exposure in the affected systems." Commission spokesman Thomas Regnier said, "These are not isolated incidents."
No one has claimed responsibility and no government has named a culprit. Dan Cimpean, director of Romania's National Cyber Security Directorate, told AFP the attacks seemed "semi-amateurish" and that "we do not suspect, under any circumstances, that it is a state actor." The October attack in France caused food losses estimated in the tens of millions of euros, the BBC reported.