Hackers heat supermarket fridges, so retailers must lock remote access
Overnight into 2 November refrigeration and freezer systems in supermarkets in Belgium, Sweden, Ireland and other countries were altered remotely, three weeks after a similar attack on hundreds of stores in France.
The attackers are going not for tills or customer data but for refrigeration controls that can be reached over the internet. The damage is immediate: spoiled stock and closed shops.
What happened
In Belgium, Delhaize reported an IT incident affecting refrigeration and freezer systems at about 40 stores and Carrefour Belgium reported problems at 15 sites; temperatures rose to around 15°C, according to the Brussels Times. In Sweden the set points at an ICA store in Sjöbo were changed to 50°C and the shop closed temporarily; Coop also reported affected branches. In Ireland, Musgrave confirmed disruption at 13 SuperValu stores. Reports also name Luxembourg, the Netherlands, Finland and Estonia. In mid-October several hundred stores were hit in France, between 150 and 700 depending on the report; there, according to Cybernews, the attacks targeted older versions of control software for Danfoss refrigeration controllers, and ANSSI, France's cyber-security agency, contacted the supplier. Danfoss released updates in 2025 and advises disconnecting vulnerable controllers from the open internet. Whether the same flaw was used in every case has not been confirmed. No claim of responsibility or ransom demand is known. Stephan Moelans, chief executive of Ahold Delhaize, said the units need physical modification and that switching to a secure connection is the quickest interim fix.
What follows
The case shifts risk into an area many companies do not count as IT: building and plant technology maintained remotely by contractors. Sabcobel, a Belgian refrigeration firm, began securing the systems it services after the French attacks; about 10 per cent were still unprotected when the new attacks came, Retail-News reports. Christophe Hansen, the EU agriculture commissioner, voiced concern; no wide disruption to food supply has been documented. Assessment: no cases have been reported in Germany, Austria or Switzerland. Similar networked refrigeration controls are used in cold stores, logistics and restaurants. For insurers and retailers the question becomes who is liable when a contractor's maintenance access was the way in.
What changes in practice
- Retailers
- Refrigeration controls reachable directly from the internet are an entry point; Ahold Delhaize names a secure connection as the quickest fix.
- IT departments
- Contractors' remote-maintenance access to refrigeration and building systems belongs on the list of critical systems, with updates and access controls.
- Customers
- No wide supply disruption has been documented; affected stores discarded stock and some closed temporarily.
What to watch
- Warnings from Germany's BSI or ENISA on networked refrigeration controls
- Attribution by investigators or a claim of responsibility
- Reports from stores in Germany, Austria or Switzerland
Sources
- Brussels Times: Suspected cyberattack hits fridges and freezers at dozens of Belgian supermarkets
- Tom's Hardware: Supermarket freezers across Europe struck in second cyberattack
- Retail-News: Neue Cyberangriffe, Hacker greifen Supermärkte in sieben Ländern an
- NL Times: Cyberattack hits Delhaize supermarket fridges at dozens of Belgium locations
- Cybernews: Hackers turn up supermarket fridges to 50°C (Frankreich, Danfoss)