Hackers remotely overheated fridges and freezers in supermarkets across at least seven European countries on Monday (November 2), the second such attack in three weeks. Belgium’s Centre for Cybersecurity says the attackers may never be traced.
Early reports named Sweden, Belgium, Luxembourg, Estonia, the Netherlands and Ireland, and later Finland. Some media outlets like The Guardian put the total at seven, naming Finland among the countries hit. Affected chains included Carrefour, the French retail giant, Delhaize, Intermarché, and Colruyt’s Spar stores in Belgium; ICA and Coop in Sweden; and Selver in Estonia. Ikea also confirmed that at least one store was hit.
Hackers heated refrigeration systems to as high as 50 degrees Celsius (122F) in some stores, forcing staff to throw away stock. Carrefour said 15 of its more than 700 Belgian stores were affected, and Swedish chain Coop said six or seven of its 800-odd stores were hit. Delhaize, Belgium's biggest supermarket chain, described an “IT incident” at several dozen stores, mostly in Belgium and a few in Luxembourg. ICA, one of Sweden’s largest grocers, said the few stores affected operate outside its central network. It did not confirm a cyberattack, but said they were connected to a refrigeration control system from Danfoss, the Danish manufacturer whose equipment was targeted in France.
The European Union condemned the attacks. Agriculture commissioner Christophe Hansen said that they were a deliberate attempt to disrupt food supplies and erode public trust. The European Commission is coordinating information-sharing through EU-CyCLONe, the EU's network of national cyber-crisis authorities.
Belgium’s Centre for Cybersecurity said that it is not known who is behind the attacks and that they may never be traced. Belgium's federal prosecutor’s office has opened an investigation. Sweden’s National Cyber Security Centre said it sees similarities to the earlier French incidents. Authorities have not confirmed whether the two waves are linked or exploited the same vulnerabilities.
French attack set the template
The same template was used in the October 12 attacks on French supermarkets. Attackers targeted refrigerators made by Danfoss, apparently manipulating their defrosting mechanisms so that the units overheated. France’s finance minister said about 700 of the country’s 10,000 supermarkets were affected. Retailers had to discard large quantities of food, and fires broke out at several stores. The French prime minister and the country’s cybersecurity agency responded publicly.
Danfoss said that most of the affected French systems were older products that no longer received software or security updates. Reuters found at least 4,500 Danfoss interfaces still visible online the day after the attack. A similar episode may have hit US military commissaries in late August, when fridges malfunctioned at about a dozen bases. The Pentagon reportedly is investigating a suspected hack.
Why supermarket fridge systems stayed exposed
The attacks exploit how modern commercial refrigeration is managed. Store fridges are controlled by software connected to the internet, so staff and suppliers can monitor and adjust them remotely. If that software is reachable from outside, anyone who finds it and gains control can issue commands, such as forcing a defrost cycle to run until the unit overheats.
Unlike phones and laptops, which regularly prompt users to install security updates, this equipment can go long periods without patches. Nick Jackson of the cybersecurity firm Bitdefender said that patching can take machinery offline, which is a problem for food retailers and the reason they avoid it. He added that many operators do not think about the risk. Coop said some of its affected fridges were connected over a 4G mobile network rather than the newer 5G system, which left them more exposed.
Researchers like Ken Munro of Pen Test Partners told Politico that supermarkets should have disconnected their fridges and monitoring devices from the internet after the French attacks, and that he accepts no excuse for not doing so. Inti De Ceukelaire, a cyber researcher said that some systems apparently were never patched. Sabcobel, the Belgian firm that installs and manages Delhaize’s refrigeration, told the news agency Belga that it had spent weeks working to protect customers’ fridges against the flaw. It said about twenty units were affected, out of hundreds it manages. The damage could have been worse had patching not begun after the French attack. Such systems are most commonly exposed online in France, Italy, Greece and Belgium, according to the security firm Forescout.
Why the fridge hackers are so hard to trace
The simplicity of the method is a big reason the culprits may never be found. The attackers apparently did not need to install any malware, so investigators have no code to examine for clues about who wrote it. The fridge management systems were reachable over the internet, so the attackers could log in and use built-in controls such as the defrost function. Rafe Pilling, a threat-intelligence director at Sophos, likened it to “wearing rubber gloves and messing with the switches.”
The usual clues are also missing. No hacktivist group has claimed responsibility, and no ransomware gang has made demands, which would be pointless since the damage is done once the fridges overheat. That leaves competing theories, none proven.
Pilling sees two plausible scenarios: a state signalling its capabilities, or a lone hacker acting for personal reasons. The state theory draws on the psychological impact of emptied shelves and on warnings from Western intelligence chiefs that Russia is waging an intensifying sabotage campaign in Europe. The Guardian said hackers linked to Russia or China are among the likelier suspects. Still, no government or agency has attributed the attacks to either, and the campaign warnings are background, not evidence.
De Ceukelaire argued that a repeat attack points to a hostile nation rather than young pranksters. Munro disagreed, saying he believes a copycat is behind Monday’s wave. After the French attack, Munro told Reuters it could have been “kids messing around”, and asked why a nation-state would hit only some French fridges. A copycat would complicate matters further, because the two waves might have different perpetrators, and one inquiry’s findings might not apply to the other. Munro offered a warning rather than an answer: “This won’t be the end of it.”
