Remote Cyber-Attacks Target Commercial Refrigeration Systems Across European Supermarkets

Supermarket refrigeration units across seven European countries have malfunctioned after being subjected to a suspected remote cyber-attack. In several instances, thermostats on the appliances were remotely adjusted to reach temperatures as high as 50 degrees Celsius, or 122 degrees Fahrenheit.

The European Union condemned the incident, characterizing it as an intentional effort to disrupt the food supply chain and erode consumer confidence. The disruptions affected retail locations including Carrefour, Intermarché, and Ikea branches in Belgium, Coop and ICA in Sweden, Delhaize in Luxembourg, Kesko in Finland, SupaValu in Ireland, and stores in Estonia.

This incident follows a similar occurrence three weeks prior, which forced French retailers to discard substantial quantities of food when appliances overheated due to anonymous hackers gaining control of internet-exposed management software. Comparable malfunctions also affected commissaries at a minimum of six United States military bases in early August, prompting an ongoing Pentagon investigation.

Security experts note that internet-connected appliances such as ovens, washing machines, dishwashers, and central heating systems share similar vulnerabilities. No ransomware extortion demands have been issued, and no hacktivist groups have claimed responsibility for the actions.

Rafe Pilling, senior director for threat intelligence at cybersecurity firm Sophos, suggested two primary attribution scenarios: a state-sponsored demonstration of capability or actions by a lone-wolf hacker. Pilling noted that state-linked theories are considered plausible due to the psychological impact on populations, while Western intelligence officials have previously reported ongoing sabotage campaigns in Europe.

Investigating the source remains difficult because the intrusion required no malware or digital weapon traces, resembling physical tampering with switches. Commercial refrigeration management software often operates on the internet and frequently lacks the regular software updates and security patches typically applied to desktop or mobile computers.