Supermarket refrigeration systems across seven European countries malfunctioned on Monday after thermostats were remotely manipulated, with temperatures reportedly raised to 50C (122F), causing widespread food spoilage and prompting the European Union to condemn what it called a deliberate attempt to disrupt the food supply chain.
The attack affected branches of Carrefour, Intermarché and Ikea in Belgium, Coop and ICA in Sweden, Delhaize in Luxembourg, Kesko in Finland and SupaValu in Ireland, as well as shops in Estonia. Swedish retailer Coop said some of its fridges were linked to a 4G mobile network that increased their exposure, while ICA confirmed its system was provided by Danfoss, the Danish company that had experienced similar problems in France three weeks earlier.
The EU's condemnation came as no group claimed responsibility for the incidents, and notably no ransomware demand was made - a notable detail given that the damage is already incurred when fridges overheat. Western intelligence officials suggested the campaign is likely the work of state actors, with Russia and China cited as the most probable attribution, as part of a broader pattern of sabotage activity that Moscow is believed to be waging in Europe.
The timing of the attacks appeared to reference incidents three weeks prior in France, when anonymous hackers seized control of internet-exposed appliance management software, forcing retailers to discard large quantities of food after fridges suddenly overheated. That earlier attack, along with mysterious malfunctions at six U.S. military base commissaries in early August that the Pentagon is investigating as a suspected hack, suggests a pattern targeting internet-connected commercial refrigeration systems.
Cybersecurity analysts note the technical simplicity of the intrusion - no malware was required, with attackers reportedly manipulating exposed switch settings. The software managing commercial fridges is frequently connected to the internet, but unlike desktop or mobile devices, such systems are often left unpatched for long periods, leaving known vulnerabilities exposed. Industry representatives said companies may delay patching because updates can require machinery to be taken offline, an unacceptable prospect for food retailers. The Belgian refrigerator group Sabcobel indicated that patching efforts initiated after the October 12 attack in France may have limited the impact of the latest incidents.
The incident underscores the growing vulnerability of internet-connected industrial control systems in critical infrastructure. UK retailers are currently working with the National Cyber Security Centre to ensure their refrigeration systems are as secure as possible against potential attacks.
