According to cybersecurity company Forescout, on 2 November a wave of remote attacks on supermarket cooling systems was recorded in several European countries, including Belgium, Sweden, the Netherlands, Estonia, Luxembourg, Finland and Ireland.
Details of the attacks and scale of losses
A similar attack occurred in France on 12 October: cooling systems in approximately 500−700 supermarkets were affected, and retailers were forced to write off products due to rising temperatures.
In some stores temperatures in the refrigerators rose to 50 °C, and some reports from Belgium indicated even higher readings. No group has claimed responsibility for the attacks so far, and investigators have not determined whether all the incidents are linked.
How hackers access refrigeration systems
Cooling systems are connected to the internet to allow remote control of temperature, management of defrost cycles, receipt of fault alerts and equipment repairs without sending technicians on site.
Controllers that are exposed to the internet and insufficiently protected allow attackers to penetrate the system and change operating settings, for example by switching evaporators to defrost mode. The company’s research found almost 13,000 externally accessible management services for refrigeration units in 99 countries and territories; this does not mean they have all been breached, but it indicates the scale of the potential vulnerability.
Artificial intelligence and the potential to scale attacks
Cybersecurity expert Pavlina Pavlova estimates that artificial intelligence could simplify the discovery of vulnerabilities and speed up the preparation of cyberattacks, making it easier to find weak points and to scale attacks across a larger number of systems.
Experts also note that refrigeration equipment is often not considered critical digital infrastructure, and responsibility for security can be split between the supermarket, the IT department and a contractor, meaning no single operator always has full control of the system.
Recommended protective measures
Suggested measures include not leaving controllers open to direct internet access, using secure remote access channels and applying up-to-date patches. If the manufacturer no longer supports a device, consider replacing it.
- Avoid using shared passwords for contractors.
- Implement individual user accounts and multi-factor authentication.
- Record changes to equipment settings.
The recurrence of attacks shows that cyberthreats can affect not only computers and digital services but also the physical infrastructure of stores — leading to direct product losses and risks to supply chains.
