European supermarket freezers hit by new suspected cyberattacks

ㅤ
In Sweden, ICA Kvantum in Sjöbo reported that hackers changed its refrigeration settings to 50°C (122°F), forcing employees to discard food and temporarily close the store.
ㅤ
ICA Supermarket Baronen in Stockholm also reported losing all its refrigerated and frozen inventory. ICA confirmed disruptions at a limited number of stores but has not confirmed a cyber-attack as the cause.
ㅤ
In Belgium, approximately 40 supermarkets were affected, while Delhaize described the refrigeration disruptions as an IT incident. Temperatures reportedly rose to 15°C (59°F) at several locations. Similar incidents are also under investigation in Ireland.
ㅤ
Coop confirmed seven affected stores in central Sweden.
ㅤ
Experts with Secure.com, Finite State, Xcape, Inc. and Black Hills Information Security offer perspectives on the matter.
ㅤ
Waseem Ahmed, Head of Engineering, Secure.com
ㅤ
“If these are cyber-attacks, as suspected, the common thread looks like remotely reachable controllers, not a fridge fault. French authorities named specific refrigeration controllers, researchers found thousands reachable from the internet, and one expert said many ran default passwords. Some older models no longer get security updates. The latest wave is still being confirmed, so I wouldn’t point at one vendor or one flaw today.”
ㅤ
“Three checks to run before the week ends. #1 - List every controller your stores run, with model and firmware. #2 - Pull the management screens off the public internet and put remote access behind a VPN. #3 - Change every shared password, including the ones your refrigeration contractor uses.”
ㅤ
“Then add temperature alarms that don’t depend on the controller being alarmed, because attackers in France reportedly lengthened defrost cycles and delayed the warnings.”
ㅤ
“Food safety now sits on gap that nobody on the security team owns. That gap is the real story, and it is fixable.”
ㅤ
Joshua Marpet, Senior Product Security Consultant, Finite State
ㅤ
“In the wake of at least two waves of successful attacks against the infrastructure supporting food distribution, we have to assume that there will be others.”
ㅤ
“That being said, this is not a moment to panic. This is a moment to reassess. And a moment to prepare. This is the moment we examine all of the devices in our infrastructure and determine which we prioritize as essential or not. This is the moment we insist that the suppliers of those essential connected devices supply us with software bills of materials, and cryptographic bills of materials at the very least.”
ㅤ
“If you’re in a critical infrastructure industry, this is the moment that determines whether you’re on the front page of the Wall Street Journal for all the wrong reasons.”
ㅤ
“How are you validating and verifying that every connected device in your infrastructure has been made as safe as you can get it? I’m not saying 100% safe. There’s no such thing. But after the French attack on refrigeration cases, why didn’t the parent companies of the supermarkets in Sweden in Belgium and everywhere else, not examine their systems?”
ㅤ
“Putting our heads in the sand is no longer a viable strategy.”
ㅤ
“Either follow the European Union cyber resilience act and get the manufacturer of your devices to handle the testing and the assurance, or contract with a third-party to make sure the devices you’re using are the right ones."
ㅤ
Damon Small, Board Member, Xcape, Inc.
ㅤ
“Supermarkets across several European countries are experiencing widespread refrigeration system disruptions following another wave of suspected cyberattacks. Stores in Sweden, Belgium, Luxembourg and Ireland have reported sudden increases in refrigerator and freezer temperatures, resulting in significant food losses and temporary closures.”
ㅤ
“These incidents highlight a fundamental cybersecurity principle: just because something can be connected to the Internet doesn’t mean it should be. Commercial refrigeration systems must be protected with the same diligence as any other operational technology (OT). Remote access, where necessary, should be restricted to secure connections such as VPNs and protected by strong identification and authentication mechanisms. »
ㅤ
“More importantly, this is not the first wave of these attacks, and it certainly won’t be the last. Manufacturers and operators of these systems should act immediately to review their security configurations, restrict unnecessary Internet exposure and strengthen access controls. Waiting for another incident is not an acceptable security strategy. There will be another round, and the consequences could be even more significant.”
ㅤ
John Strand, Owner, Black Hills Information Security
ㅤ
“When we look back at 2026 years from now, we’re going to remember it as the year the refrigerator was on fire instead of the dumpster.
ㅤ
“Do we really need refrigerators connected to the internet at all times? Sometimes I think that maybe, just possibly, and I’m just throwing this out there, things might be a little too connected.
ㅤ
“But the real security issue is what happens when you combine IoT and embedded devices with a SaaS provider and centralized management. You have devices that often don’t have EDR or a patching plan, and then you tie them into a portal that can control a whole bunch of them.
ㅤ
“Attackers can go after the individual device, or they can compromise one SaaS portal and potentially gain access to multiple devices. That’s how a problem with one system can turn into widespread disruption.”