European Supermarket Refrigeration Systems Targeted in Remote Cyberattacks
Attackers exploited vulnerable refrigeration controllers across Europe, forcing food disposal and triggering security investigations.
1Coordinated Refrigeration System Attacks
On November 2, attackers remotely manipulated refrigeration controls across Belgium, Sweden, and Estonia. By switching units into defrost mode or raising temperature settings, they compromised food safety in multiple supermarket chains. This incident follows a similar wave of attacks targeting hundreds of French supermarkets just three weeks prior to these events.
2Operational Impact on Retailers
Supermarkets were forced to discard significant amounts of chilled and frozen inventory due to temperature spikes. For instance, a butcher shop in Hove reported losses totaling approximately 15,000 euros. While some chains like Musgrave proactively removed products from sale, others like Estonia's Selver resolved the temperature issues within ten minutes without damage.
3Vulnerability in Industrial Hardware
The attacks primarily targeted refrigeration controllers manufactured by Danfoss and Copeland. Investigations revealed that many compromised systems were running outdated software or utilizing default passwords. Security experts noted that these internet-connected devices, intended for remote maintenance by contractors, lacked the necessary network security layers to prevent unauthorized external access by malicious actors.
4Technical Attack Vectors
Attackers gained entry by exploiting individual supermarket systems rather than contractor networks. In the Netherlands, systems hit were not on secure networks and retained default credentials. While some stores implemented security measures following the French attacks, those that remained unpatched or improperly configured were successfully targeted again during this November wave.
5Manufacturer and Regulatory Response
Danfoss has advised customers to disconnect systems from the public internet and utilize secure network connections. CERT-FR issued an alert covering specific Danfoss and Copeland controller series, warning that end-of-life devices are highly susceptible to compromise. Authorities in Belgium and Sweden have launched investigations to track the perpetrators and assess the scope.
6Limitations of Software Updates
Experts emphasize that software patches alone are insufficient for older hardware. Physical infrastructure changes are often required to secure these legacy systems, which adds significant costs for retailers. Many affected units were identified as older models, such as the AK-SM 800, which no longer receive active security updates from the manufacturer.
7Security Best Practices
National cybersecurity agencies recommend auditing all internet-connected devices to determine if remote access is truly necessary. For systems that must remain online, organizations should implement multi-layered security protocols and ensure all firmware is current. Factory resets are insufficient for compromised devices unless followed by a complete re-configuration and secure network isolation.
8Broader Implications for Infrastructure
These incidents highlight the critical risks associated with the rapid digitization of industrial refrigeration. As retail infrastructure becomes increasingly interconnected, the reliance on legacy controllers creates a persistent attack surface. The inability to definitively attribute these attacks suggests that such vulnerabilities will remain a recurring threat to supply chain integrity.