Very cold war: Who’s attacking Europe’s supermarket freezers?

On Monday, fridges and freezers at more than 100 shops in several European countries were compromised in cyberattacks that raised temperatures, causing significant food spoilage. The attacks began last month when hundreds of French supermarkets experienced similar incidents, costing millions of euros in damages and food waste.

The cyberattacks have spread across the continent and even reached the United States, where military bases reported freezer malfunctions that were considered suspected hacks. Belgian authorities have opened a criminal investigation into the latest incidents, though no group has claimed responsibility.

European retailers affected

Multiple supermarket chains across Europe have confirmed being targeted. Dutch operator Delhaize reported dozens of its shops in Belgium and Luxembourg were hit by an "IT incident". French retailer Carrefour said about 15 of its 700 Belgian locations experienced refrigeration problems.

The Colruyt group, which runs Spar stores in Belgium as franchises, confirmed five of its shops were affected. Swedish Coop reported cooling system disruptions at seven of its 800 stores, while IKEA acknowledged one site in Mons, Belgium, was compromised.

Belgian butchery chain De Laet & Van Haver revealed that temperatures in its fridges at a store in Hove reached as high as 18 degrees Celsius, ruining meat worth approximately 15,000 euros. Irish food wholesaler Musgrave reported a cyber-incident affecting refrigeration systems in 13 of its SuperValu stores.

US military incidents

In the United States, military bases experienced similar issues. In August, freezers at a market on Fort Huachuca, an Army base in Arizona, entered defrost mode, spoiling all contained frozen food. The naval station in Newport, Rhode Island, also reported its refrigeration system was affected, leaving only dry goods available for purchase.

The Pentagon classified these freezer malfunctions as suspected hacks, with investigators communicating with French authorities about the incidents. These events suggest a coordinated international campaign targeting critical infrastructure.

Attack methods and vulnerabilities

Hackers are accessing internet-connected refrigeration systems and raising temperatures to spoil food. In some cases, temperatures were increased to as high as 50C (122F), causing appliances to melt or catch fire. Professor Awais Rashid explained that many supermarket refrigeration systems are remotely managed by third parties without necessary software updates.

Rashid highlighted vulnerabilities including "easily guessable" passwords and outdated controllers, often past their end-of-life. These security lapses allow unauthorized access to systems controlling temperature settings and maintenance functions.

Motives and investigations

The motive behind the attacks remains unclear, though authorities believe it may be a deliberate attempt to disrupt food supplies. European Commissioner for Agriculture and Food Christophe Hansen described the attacks as a "deliberate attempt to disrupt" the bloc's food supply and undermine consumer confidence.

While "food security is not currently at risk," Hansen acknowledged that "the food waste and impact on businesses are real." Theories have emerged linking state actors to these cyberattacks, with European intelligence officials warning about Russia's escalating shadow war on the continent. The UK's National Cyber Security Centre recently warned that Britain needs to prepare for AI-powered cyberattacks on critical infrastructure within the next two years.

As infrastructure becomes increasingly digitized, Rashid noted that the risk of disruption from cyberattacks has risen, particularly for "cyber-physical infrastructures such as refrigeration systems." He emphasized that good security practices are essential for maintaining trust in the digital infrastructures people rely on daily.