Supermarkets across Europe have been forced to throw away spoiled food after hackers took control of refrigeration systems and cranked temperatures up to 50 degrees Celsius, raising fresh concerns about the security of critical infrastructure.
The latest wave of attacks, reported on 3 November, affected retailers in countries including Belgium, Sweden, Ireland, Finland and the Netherlands. Supermarket chains including Carrefour, Delhaize, ICA and Coop were among those affected, with a store in Stockholm reporting that its freezers had reached 50 degrees Celsius.
The incidents followed a similar attack in France in October, when hackers manipulated refrigeration controls at around 700 supermarkets, causing substantial food losses.
British businesses have also been affected. According to reports, three UK meat suppliers were targeted through vulnerable Copeland XWEB refrigeration controllers, with attackers remotely triggering defrost cycles and changing temperature settings.
London-based organic wholesaler Langridge Organic also confirmed that hackers had compromised six of its ten cold-room control systems, setting temperatures as high as 66 degrees Celsius and disabling automated warnings.
While the immediate consequences have largely been financial, the incidents demonstrate how cyberattacks against relatively mundane equipment can cause physical disruption without targeting traditional IT systems. They also highlight a potential vulnerability in food supply chains and other civilian infrastructure that governments increasingly recognise as important to national security.
Gianni Cuozzo, founder and CEO of European cybersecurity company Exein, said reliance on centrally managed refrigeration equipment creates opportunities for attackers to disrupt multiple locations.
“Refrigeration controllers are small, internet-connected computers that talk constantly to a central back-office system, so one weak point can reach a whole fleet,” he said. “Many haven’t been updated in years and have no security on board. Patching can wipe their configuration, so operators avoid it. With little effort, attackers can cause millions of euros in damage.”
Ed Rowley, Solutions Engineer at HackerOne, said the need to keep refrigeration equipment running around the clock makes securing it particularly difficult.
“Fridges and freezers need to be managed remotely, but that can risk leaving controls exposed,” he said. “These systems are often operated by third parties and taking them offline to administer security updates can be difficult when they’re running 24/7.”
The threat has also extended beyond food retailers. On 4 November, French authorities confirmed that hackers had tampered with refrigeration systems at three blood storage facilities, changing temperature settings and attempting to trigger defrost cycles. The attacks put valuable plasma supplies at risk, although staff spotted the changes quickly enough to prevent any losses.
The targeting of blood banks raises the stakes considerably, according to Cassius Edison, COO of Closed Door Security, who said the potential damage goes well beyond the financial losses supermarkets suffered.
“While the attacks on supermarkets have been economically damaging and disruptive, damaged stock can be costed and absorbed to some degree,” he said. “Blood banks do not operate on this model, and blood is a critical resource for numerous medical applications which can’t easily be replaced.”
Edison also warned that state-backed groups could exploit the same weaknesses to cause economic disruption rather than steal data or demand ransom. “For other threat actors, especially those backed by foreign states, attacking these systems is both trivial and an effective means of inflicting economic damage,” he said.
There is no confirmed evidence that state-sponsored actors were responsible for the recent incidents, but the attacks illustrate how weaknesses in civilian infrastructure could be exploited as part of wider hybrid warfare campaigns.
The incidents have also renewed scrutiny of how connected devices are secured throughout their operational lives.
James Stanley, head of engineering at German industrial technology group WITTENSTEIN, pointed to the EU Cyber Resilience Act, which introduces requirements for secure-by-design development and vulnerability management throughout a product’s declared support period.
“Many embedded systems are designed to run for years, so manufacturers need to consider how they will be kept secure and how vulnerabilities will be dealt with over time,” he said.
Cuozzo argued that manufacturers must also build safeguards into individual devices to prevent them from obeying commands that could cause physical damage. “A refrigeration unit should recognise that heating to a dangerous temperature makes no sense and reject the command, even from a system it normally trusts,” he said. “Compromising one central system should not mean compromising every device connected to it.”
The perpetrators and their motives remain unknown, but the attacks have exposed weaknesses that extend well beyond supermarket freezers. With European governments increasingly concerned about hybrid warfare, the security of equipment supporting food supplies, healthcare, and other essential services is becoming a matter of national resilience.
