When Hackers Target Freezers; Europe's Supermarkets Face Unique Digital Threat

Europe Freezer Cyberattack: Supermarket refrigeration systems in at least nine European countries were remotely manipulated overnight on Monday, November 2, forcing retailers from several outlets discard spoiled food; the European Union called the incidents a deliberate attack on the food supply chain. The suspected cyberattacks, which in some stores raised freezer temperatures to 50C, followed a similar wave in France three weeks earlier and have renewed concern that everyday internet-connected equipment may become a new target for disruption.

The immediate question, alongside who breached the systems, is why commercial refrigeration, mundane, largely overlooked infrastructure, has become an effective way to create visible public alarm without shutting down other key aspects, like payments, logistics networks or national power grids.

The Affected Chains

Retailers reported sudden temperature spikes in fridges and freezers during the night of November 2, causing them to discard the spoiled food. Sweden, Belgium, Luxembourg, Ireland and Estonia, reports AP, however BBC includes Finland, Italy, the Netherlands, Portugal, Germany to its reported list.

Belgium

In Belgium, Carrefour said 15 of its more than 700 stores were affected and described the impact as “extremely limited.” A spokesperson told ABC News that “all stores remain open because it only concerns a few refrigeration units, mainly freezers.”

Delhaize said an “IT incident” had affected refrigeration systems in several dozen stores, mostly in Belgium and a smaller number in Luxembourg. “In the affected stores, the range of fresh and frozen products is temporarily somewhat limited. Our distribution centres are operating normally, and there has been no disruption to deliveries to our stores,” spokesperson Sarah De Meester said, as reported by the AP

Sweden and Estonia

In Sweden, ICA Group spokesperson Gustaf Nilsson told the TT news agency that “a limited number” of stores had been affected by an overnight incident involving refrigeration and freezing systems. The company did not give a store count.

An ICA Kvantum store in Sjöbo, southern Sweden, said in a Facebook post that its fridges and freezers had been hacked and set to 50 degrees Celsius, and that staff were discarding affected products. The post was widely reported by AP, the BBC and NBC News.

Coop said six of its stores in central Sweden had experienced problems, according to TT; later reporting by ABC News put the figure at “seven out of more than 800 stores.” That discrepancy should be checked directly with Coop before publication.

In Estonia, Jann Mutso, head of refrigeration technology company Kitman Coldtech, told public broadcaster ERR that attackers accessed the control computer of an older Danfoss refrigeration system used by a client and raised the temperature to 50 degrees. Though, he refused to identify the affected store, Selver later confirmed that one of its outlets had been affected.

Ireland

In Ireland, 13 SuperValu stores were affected. A Musgrave Group spokesperson told The Irish Times that chilled and frozen products had been removed from sale as a precaution.

How the attack worked

The apparent technique involved unauthorised access to refrigeration-management systems connected to the internet. Belgian refrigeration group Sabcobel said affected units’ evaporators were switched into defrost mode, causing them to warm up, the same method that has been believed to have been used in the earlier French attacks.

Unlike ransomware, the incident did not initially appear to involve data theft or a payment demand. Cybersecurity reporting noted that no malware was necessarily required, making it harder to find suspects and attribution; Sophos threat-intelligence director Rafe Pilling described the method, as quoted by The Guardian, as comparable to “wearing rubber gloves and messing with the switches.”

Why the systems were vulnerable

The suspected method mirrors the October cyberattacks in France, where hackers allegedly gained access to internet-exposed refrigeration-management software and manipulated cooling units. 

The attacks did not appear to involve ransomware, data theft or a shutdown of supermarket operations. Instead, they exploited a narrow but disruptive weakness: remote management software for commercial cooling systems.

That makes the incident less like a conventional ransomware attack and more like a demonstration of reach. A thermostat changed from about minus 18C to 50C can ruin stock, force closures and generate photographs of workers clearing shelves, precisely the kind of visual disruption that spreads quickly online.

Cybersecurity experts told The Guardian that the simplicity of the method complicates attribution. Rafe Pilling, senior director of threat intelligence at Sophos, said the most plausible explanations were “some kind of state-based signalling and demonstration of capability” or “some kind of lone-wolf hacker” acting for personal reasons.

Who is responsible?

No hacktivist collective or ransomware group has claimed responsibility, and neither European institutions nor national cyber agencies have named a suspect.

Pilling told The Guardian that the two most plausible scenarios were “some kind of state-based signalling and demonstration of capability or some kind of lone-wolf hacker.” 

Official response

The European Commission said it was taking the incidents seriously, treating the incidents as a coordinated security concern, and warned that repeated attacks on food retail infrastructure were deeply concerning. Hansen said the attacks represented “a deliberate attempt to disrupt our food supply chain,” according to CNBC and AFP.

Italy’s government held emergency talks with intelligence chiefs on Tuesday, November 3, after the incidents spread further across the continent, AFP reported.

EU Agriculture and Food Commissioner Christophe Hansen said the attacks were “a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it, a warning that we must take seriously,” according to AFP.

European Commission spokesperson Thomas Regnier said the incidents were “not isolated” and that Europe had to be “collectively resilient and prepared for such cyber incidents.” He declined to speculate on responsibility, saying attribution was a matter for national authorities.

Brussels convened two coordination meetings on Tuesday: one involving EU bodies including ENISA and Europol, and another through the EU-CyCLONe cyber-crisis network with national authorities from affected member states.

ENISA said the cross-border scale of the attacks “underscores the importance of European cooperation, rapid information-sharing and coordinated responses to cyber incidents,” as reported by Reuters.