Hackers Target Refrigeration Systems, European Retailers Forced to Waste Food

Recent cyberattacks targeted refrigeration systems in European supermarkets, causing food waste and operational disruptions.

Incident Overview

Cybercriminals manipulated refrigeration systems in European supermarkets, leading to the disposal of perishable goods as attackers adjusted cooling parameters. The incidents, reported across multiple nations, involved unauthorized modifications to temperature controls, forcing retailers to discard chilled and frozen products. The attacks occurred on November 2, with subsequent disclosures revealing impacts in Germany and the UK.

Key Locations and Affected Entities

At an ICA Kvantum location in Sjöbo, Sweden, refrigeration settings were set to 50°C (122°F), according to staff reports. A second ICA store in Stockholm experienced similar disruptions, though no independent verification of internal product temperatures was provided. Belgian firm Sabcobel confirmed that attackers activated defrost cycles on evaporators, causing equipment to overheat.

Specific Impacts

Delhaize stores in Belgium and Luxembourg
15 Carrefour locations in Belgium
13 SuperValu stores in Ireland
UK-based cold-storage providers
Three abattoirs compromised, per the Association of Independent Meat Suppliers

Responses and Mitigation Efforts

Some businesses have resumed operations after isolating refrigeration controllers from network connections, while others continue assessing equipment managed outside centralized IT systems. Langridge Organic, a London wholesaler, disclosed that six of its ten cold-room controllers were altered, with automated temperature alerts disabled. Employees detected anomalies through manual checks and disconnected the systems from the internet.

“Technicians worked overnight to physically secure systems, with some requiring hardware modifications rather than software patches,” said Sabcobel CEO Stephan Moelans.

Previous Attacks and Warnings

The November incidents followed earlier attacks in France on October 12, when altered refrigeration systems caused food losses at hundreds of stores. Some locations experienced fires, according to reports. France’s CERT-FR identified compromised Danfoss AK-SM and AK-SC controllers, along with Copeland and Dixell XWEB systems.

Expert Analysis and Recommendations

Experts noted that many affected systems used default passwords and older models lacking security updates. Waseem Ahmed of Secure.com highlighted remotely accessible controllers and aging infrastructure, cautioning against attributing all incidents to a single cause. Joshua Marpet of Finite State advised organizations to prioritize critical infrastructure and prepare for potential disruptions.

Industry-Wide Implications

The incidents underscore the growing risks of cyberattacks targeting industrial control systems, with implications for food safety, supply chain stability, and public health. Sweden’s crisis-information service provided no public guidelines for consumers but directed businesses to review operational technology controls for refrigeration and other essential systems.