Cyber-attacks target European supermarket refrigeration

Nov 7 · CISA monitors malicious activity targeting cold-chain systems Updated 01:20

Newsweek reported that the Cybersecurity and Infrastructure Security Agency (CISA) is monitoring malicious activity targeting cold-chain systems. According to cybersecurity experts cited by Newsweek, U.S. supermarkets are vulnerable because they use refrigeration controllers similar to those in Europe that are often connected to the internet for remote maintenance.

CISA's monitoring of cold-chain systems and the warnings about U.S. supermarkets confirm that the vulnerability of internet-connected controllers is a global systemic risk, not a regional European failure. Newsweek identifies these unsecured devices as "low-hanging fruit," reinforcing the first analysis that the industry's reliance on remote maintenance over secure architecture creates an open invitation for disruption [2].

The Guardian shifts the perspective from technical vulnerability to societal resilience. By framing the attacks as "greyzone aggression," it argues that because these infrastructure gaps are inevitable, the only viable defense is active civil preparedness and stockpiling [1]. This moves the conversation beyond how to patch a controller to how a state should prepare its citizens for the inevitable failure of basic services.

While Newsweek provides the necessary link to U.S. infrastructure, it presents a conflicting view on the scale of the threat. It balances the warning of vulnerability with the claim that a large-scale coordinated attack is unlikely due to the resources required [2]. This leaves an open question: whether the current attacks are opportunistic tests by lone actors or a calculated, low-resource demonstration of capability by a state actor.

Nov 5 · Politico Europe reports French store attacks occurred October 11-12 Updated 00:33

Politico Europe reported that the attacks hitting French stores occurred on October 11-12. European Commission security officials are investigating the incidents, and EU Agriculture and Food Commissioner Christophe Hansen characterized the attacks as a deliberate attempt to disrupt the food supply chain. Former FBI Special Agent Nicole Parker described the threats as 'asymmetrical warfare' designed to shake public security by targeting basic necessities and warned that cyberattacks targeting grocery store refrigeration systems could be used as 'psychological warfare' against Americans, according to Fox News. Fox News also reported that the Army Criminal Investigation Division is investigating the refrigeration outages at U.S. military commissaries in August, though a cyberattack has not yet been confirmed as the cause.

Politico Europe provides a concrete timeline by dating the French attacks to October 11-12. The characterization of these events by EU Commissioner Christophe Hansen as a deliberate attempt to disrupt the food supply chain elevates the incident from a technical failure to a targeted attack on essential infrastructure.

Fox News shifts the interpretation from infrastructure vulnerability to psychological warfare. By citing Nicole Parker's description of 'asymmetrical warfare,' the reporting suggests that the goal is not just food waste, but shaking public confidence by targeting basic necessities. This framing moves the conversation from how the systems were hacked to how the resulting instability is used as a tool of intimidation.

While Fox News connects these events to U.S. military commissaries, it acknowledges that a cyberattack has not yet been confirmed as the cause in those cases. This distinction is important to prevent the narrative of a global campaign from outpacing the actual forensic evidence.

Nov 4 · Cyber-attacks on supermarket refrigeration systems affect chains across at least 10 European countries Updated 19:54

The BBC reported that cyber-attacks targeting supermarket refrigeration systems have affected chains across at least 10 European countries, including Italy, Germany, and Portugal, and that some attacks targeted external service providers. The Italian government attributed the success of the attacks to obsolete security systems in affected businesses. Breitbart reported that the supermarket chain EDEKA was among the targeted locations and that the attacks affected over 100 locations; Breitbart also stated that some industry members speculate the attacks could be linked to anti-meat campaigners. CNBC reported that suspected hacks at U.S. military bases occurred in August, and analysts cited by CNBC suggest the motive could be psychological disruption or geopolitical pressure on nations supporting Ukraine. The BBC reported that the National Cyber Security Centre predicted AI-powered attacks on critical infrastructure within two years. PBS reported that cybersecurity experts state there is no evidence AI was used in these specific attacks, and that experts and officials attribute the breaches to 'technical debt,' specifically the use of outdated hardware, end-of-life firmware, and default passwords.

The expansion to 10 countries and the targeting of external service providers reported by BBC confirms that the vulnerability is not limited to individual store settings but is a systemic failure of the service ecosystem. The Italian government's attribution of the success to obsolete security systems reinforces the conclusion that the bridge between the internet and physical hardware remains an open door due to neglected maintenance.

PBS provided a critical insight by framing the breaches as a result of technical debt. By identifying the use of end-of-life firmware and default passwords, PBS highlights a systemic tendency to prioritize new technology over the basic maintenance of legacy systems that sustain essential operations.

Interpretations of the motive have diverged. CNBC links the events to suspected hacks at U.S. military bases to suggest a geopolitical strategy of psychological disruption against Ukraine's supporters. Conversely, Breitbart reports industry speculation that the attacks may be the work of anti-meat campaigners, framing the event as ideological sabotage.

While BBC provides the necessary scale of the crisis, it misses the opportunity to investigate the specific role of the external service providers it mentions. Whether these providers acted as a single point of failure for multiple chains remains an open question that would determine if the industry's risk is concentrated in a few third-party vendors.

Nov 3 · Belgium's prosecutor's office launches criminal investigation into refrigeration cyberattacks Updated 05:21

On Monday, November 2, cyberattacks affected supermarket fridges and freezers across seven European countries, including Estonia, the Netherlands, and Finland. In Estonia, a client of Kitman Coldtech experienced temperatures remotely raised to 50 degrees Celsius; Kitman Coldtech CEO Jann Mutso confirmed a cyberattack on a client's cooling system and stated the response was rapid. Affected chains include Carrefour and Selver. In Ireland, 13 SuperValu stores were affected, and owner Musgrave stated a specific refrigeration model was the issue. Newsweek reported that temperatures at Ica and Coop shops in Sweden reached as high as 55C. ICA and Coop in Sweden stated they had no immediate confirmation of a hack, though one ICA store claimed on Facebook that it was hacked. The ICA Kvantum branch in Sjobo, Sweden, reported that temperatures in their systems were remotely dialed up to 50 degrees Celsius. Axfood is among the retailers that reported incidents where freezers were hacked or switched to defrost mode. Sabcobel, a Belgian refrigeration company, stated a cyberattack switched evaporators into defrost mode. Approximately 75 stores were affected in Belgium, including locations from Intermarché and IKEA, and Colruyt Group confirmed impacts to its stores. Belgium's prosecutor's office has launched a criminal investigation. Newsweek reported that the attacks led to the loss of food worth millions of euros.

Euronews reported that these events are believed to be linked to a similar attack in France in October utilizing a vulnerability in software supplied by Danfoss. UNITED24 Media reported that a similar attack in France three weeks prior affected approximately 700 stores and that some incidents were linked to unsecured networks and default passwords in equipment from Danfoss and Copeland. The NY Post reported that the French attacks from last month targeted older systems, and CBS News reported this caused some equipment to overheat and spark fires. Danfoss stated that the vulnerability primarily affects customers using outdated software. Some refrigeration experts argue that software updates alone are insufficient and that physical modifications or secure internet connections are necessary for full protection. Some companies noted that the incidents occurred before planned system upgrades were to be implemented following the attacks in France.

EU Commissioner Christophe Hansen and Cooperative U CEO Dominique Schelcher described the attacks as a threat to food security. The European Commission noted that these events highlight how digital threats are increasingly affecting daily life. Sweden's national cybersecurity center reported that many operational technology devices remain unpatched and exposed. No group has claimed responsibility for these attacks to date. Al Jazeera reported that the incidents have raised concerns about hybrid warfare linked to Russia and Iran. The Guardian reported that similar suspected hacks occurred at US military commissaries and that cybersecurity experts suggest the attacks likely stem from state-based actors demonstrating capability or lone-wolf hackers, mentioning Russia and China as possibilities. Retailers in the UK are working with the National Cyber Security Centre (NCSC) to prevent similar attacks. UK Cyber Defence researchers identified over 800 refrigeration and building-control interfaces associated with British retailers that are accessible over the public internet, and the BBC reported that the NCSC is investigating the supermarket incidents.

The attack mechanism is now concrete. CBS News identified that hackers switched evaporators into defrost mode, confirming that the bridge between the internet and physical hardware is being used as a weapon. This shift from data theft to physical manipulation has escalated in danger; CBS News reported that previous attacks in France caused equipment to overheat and spark fires, moving the risk from food waste to physical safety and infrastructure damage.

Euronews provided the most critical technical context by linking the attacks to a vulnerability in Danfoss software. While Danfoss claims the issue primarily affects outdated software, Euronews highlighted expert warnings that software updates alone are insufficient and that physical modifications or secure connections are required for full protection. This directly addresses why these vulnerabilities persist despite repeated warnings.

BBC provided a crucial piece of evidence by reporting that UK Cyber Defence researchers identified over 800 refrigeration and building-control interfaces associated with British retailers that are accessible over the public internet. This transforms the event from a series of unfortunate hacks into a systemic exposure of retail infrastructure.

The Guardian and Al Jazeera expanded the scope of the threat, linking the incidents to suspected state-based actors from Russia, China, or Iran. This shifts the interpretation from opportunistic cybercrime to a demonstration of capability in hybrid warfare, especially as The Guardian noted similar suspected hacks at US military commissaries.

Most other reports, including NBC News and PBS, focused on the expanding list of affected countries and chains. They treat the event as a growing list of victims rather than questioning why critical food infrastructure remains exposed to the public web with known flaws.