‘A freezer should never accept an instruction to heat to 50°C, no matter who sends it’: More supermarkets hit by suspected cyber attack

Supermarkets across Europe have reported their refrigerators and freezers were remotely tampered with, raising temperatures above 40ºC and spoiling hundreds of thousands of euros worth of food.

Initial reports suggest the incidents, which occurred in the early hours of Monday morning, were the result of a cyber attack targeting internet-connected refrigeration systems.

Dozens of Delhaize and Carrefour supermarkets were affected across Belgium and Luxembourg, as well as some Spar stores, Le Soir reported.

This was in addition to several incidents reported by Sweden’s ICA and Coop chains, while Irish food wholesaler Musgrave said 13 SuperValu stores were affected, according to Reuters.

A small number of supermarkets in the Netherlands, Estonia, and Finland have also reportedly been affected.

According to RTL Info, managers of Delhaize stores were sent a text message at around 4am warning them of sudden temperature increases in the refrigeration units, while initial reports suggest the attack itself happened at around 2am.

One store manager at Sweden’s Ica Kvantum in Sjöbo, who estimates the value of the destroyed goods at several hundred thousand kronor, described the incident as “a form of terrorism” to DN.

The incidents come just weeks after a similar attack on French supermarkets that saw temperatures remotely raised to 50ºC overnight, resulting in millions of euros’ worth of damage to both food and stores.

It is not yet known if these incidents are linked. However, Stephan Moelans, CEO of refrigeration systems specialist Sabcobel, which operates systems for Delhaize supermarkets, told RTL Info that he believes the attackers used the same method as in the October attack.

Moelans also told the Belga news agency that since the French attack in early October, Sabcobel had been working to “protect our customers’ fridges against this vulnerability” but that the units needed physical modifications.

An on-going problem

Experts warn that these incidents could encourage further attacks, particularly because disrupting refrigeration systems can cause substantial damage without requiring sophisticated malware.

“Three weeks after France, supermarkets in Belgium and Sweden have been hit in the same way. This is no longer a one-off incident. It is a method that works, and attackers will keep using it until it stops working,” says Patrick Lamplmair, CTO and co-founder at cybersecurity company Tributech.

He says the attacks are attractive because “it’s cheap and the damage is immediate”. Rather than stealing data or demanding a ransom, attackers can manipulate temperature controls and destroy stock overnight, causing havoc for businesses.

This second attack also highlights concerns about how vulnerable refrigeration systems are exposed to the internet.

Last week, Forescout’s Vedere Labs research lab warned that following the attacks in France, other European countries could be next. Its own research identified 12,976 internet-exposed refrigeration service observations across 99 countries, particularly in Italy and Greece.

Daniel dos Santos, VP of research at Forescout told ITPro that many businesses often treat refrigeration systems as long-term investments, and as a result, equipment may remain in service long after software support ends, while organizations lack the budget to replace or upgrade it.

“That creates a difficult gap between the equipment’s useful physical life and its supported digital life,” he said.

“Where updates are available, applying them requires coordination with the people responsible for keeping refrigeration running. Where support has ended, organisations need a replacement plan and immediate controls to restrict exposure in the meantime.”

Securing refrigeration systems

Addressing the problem of vulnerable systems requires more than simply applying software patches, says Lamplmair.

“Patching will always lag behind attackers. The lasting fix is to stop trusting the network and verify at the asset itself. Each command should prove its origin and that it was not altered, and each setpoint should be checked against physical limits before it runs.”

“A freezer should never accept an instruction to heat to 50°C, no matter who sends it,” he adds.

Lamplmair argues that these safeguards must be built into connected products from the outset, rather than added later as an afterthought.

“Under the EU Cyber Resilience Act, manufacturers of connected products are becoming legally responsible for exactly this. Operators should ask their suppliers now how commands to their equipment are verified,” he says.

Dos Santos echoes this, adding that companies can be proactive by identifying internet-exposed systems, removing direct public access, and providing necessary maintenance through secure remote access with strong authentication.

“They should eliminate default and shared maintenance credentials, patch supported equipment, and budget for replacing unsupported systems,” he adds.

“Protecting the physical processes a business depends on must become part of everyday cyber resilience planning.”

FOLLOW US ON SOCIAL MEDIA

Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.

You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.