Cyberattacks on supermarket refrigerators affected at least 11 European countries

What happened

In recent days, Europe has recorded a series of cyberattacks on supermarket refrigeration control systems: attackers remotely raised the temperature in refrigerators and freezers, forcing retailers to throw away spoiled food. According to AFP, the attacks affected at least 11 countries: Belgium, Estonia, Finland, Germany, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Romania and Sweden. Euronews adds that the United Kingdom was also affected, which is not an EU member. No one has claimed responsibility for the incidents, and the motive remains unknown.

The authorities' response

The Italian government held an emergency meeting on Tuesday with the heads of the intelligence services and the National Cybersecurity Agency, which issued technical recommendations to retailers. Italian authorities said the impact so far is 'extremely limited': only stores with outdated security systems were affected — those whose interfaces were exposed to the internet and whose authentication mechanisms had vulnerabilities; about 20 affected stores are reported across the country. European Commission spokesman Thomas Regnier said EU agencies were discussing with national authorities on Tuesday 'how best to respond collectively,' stressing: 'These are not isolated incidents.' EU Commissioner for Food and Agriculture Christophe Hansen called the attacks 'a deliberate attempt to disrupt our food supply chain and undermine consumer confidence' and warned that this is a signal that must be taken seriously. Regnier, however, refused to name possible perpetrators.

Scale by country and theories about the perpetrators

The number of affected stores varies considerably from country to country. In Italy, according to Giuseppe Spadaro, director of the group that manages Coop supermarkets in Sicily, four of the chain's 300 stores were attacked; he estimated the damage at 'several thousand euros' and told Corriere della Sera: 'We had to throw everything away. The shelves are empty.' In Germany, four stores were affected, and in Romania, six. Dan Cimpean, director of Romania's National Cybersecurity Directorate, told AFP that no other infrastructure was compromised and offered an assessment different from that of Brussels officials: 'This looks like semi-amateur work. Under no circumstances do we suspect that a state actor is behind this.' In Sweden, seven affected Coop stores have already returned to normal operation; chain representative Carlos Cansinos explained that the affected equipment was connected via older 4G mobile networks, and the company is migrating its refrigerators to 5G as part of a modernization program. Belgium turned out to be among the hardest-hit countries — dozens of stores across several chains reported refrigeration failures there, and the federal prosecutor's office has opened an investigation.

Context and equipment vulnerability

The incident occurred three weeks after a similar cyberattack on hundreds of French supermarkets, which were also forced to discard spoiled goods. In the UK, Richard Horne, head of the National Cyber Security Centre, told the BBC that the problem had affected 'the entire food supply chain' and that there were several cases in which 'vulnerable technology was exploited'; according to him, centre staff 'worked through the night' warning those at risk. The Association of Independent Meat Suppliers (AIMS) told the BBC that refrigerators at two of its members began to defrost, and at another, the temperature in refrigeration units rose sharply. The reason for the broad vulnerability is that supermarket cooling systems are often connected to the internet so that contractors can remotely monitor their operation and repair equipment: according to research by Forescout cited by Euronews, nearly 13,000 refrigeration management services in 99 countries are openly accessible on the internet. The publications do not report who is behind the attacks or what their goals were.