Summary
- Retailers in seven European countries reported refrigeration disruption on 2 November.
- Remote manipulation of controls caused food losses and operational interruptions.
- Exposed industrial systems and contractor access are under renewed scrutiny.
Supermarkets in seven European countries have reported disruption to refrigeration systems after attackers remotely interfered with temperature controls, extending a campaign that forced French retailers to discard chilled stock in October.
Retailers in Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands, and Sweden reported problems on 2 November. Among the affected businesses were stores operated by Carrefour, Delhaize, Coop, ICA, and SuperValu, with Irish wholesaler Musgrave identifying disruption at 13 SuperValu sites.
The incidents involved equipment used to maintain safe food temperatures. Some affected systems reportedly entered defrost cycles or recorded temperatures far above normal operating ranges, leaving stores to assess product safety and remove stock that could no longer be sold.
The latest reports followed attacks on French supermarkets three weeks earlier. The Paris prosecutor’s office identified approximately 700 victims in that episode, which focused attention on remotely accessible controllers used by refrigeration contractors and facilities teams.
The information available does not establish whether every incident involved the same technical route or was carried out by one group. Authorities have not confirmed a common perpetrator across all the countries involved, and accounts of the mechanisms differ in detail.
Commercial refrigeration controllers regulate compressors, defrost cycles, and temperature setpoints. Remote administration allows specialist providers to monitor systems across geographically dispersed shops, but an internet-accessible management interface can also expose physical equipment to unauthorised instructions.
Martin Riley, CTO at Bridewell, described the consequence succinctly: “A supermarket fridge holds no secrets. It holds a temperature.” Unlike an encrypted database, perishable stock cannot be recovered from a backup once it has spent too long outside safe conditions.
Stores also face costs beyond the destroyed products. Refrigeration systems must be checked, contaminated or spoiled goods removed, stock replaced, and food safety procedures repeated. Closures and visible empty shelves can amplify losses as staff attempt to restore normal trading.
Riley said distributed retail estates and outsourced maintenance are central to the exposure. Refrigeration units are often serviced by specialist contractors who use remote connections to avoid travelling to each location. Those connections may not fall within the retailer’s ordinary IT security inventory or monitoring.
Patrick Lamplmair, CTO and Co-Founder of Tributech, said: “This is no longer a one-off incident. It is a method that works, and attackers will keep using it until it stops working.” His observations point to the ease with which repeatable attacks can impose immediate physical losses.
Lamplmair advocates asset inventories, removal of direct internet exposure, timely updates, and stronger assurance of control commands. His proposed design would verify the origin and integrity of an instruction and check it against safe physical limits before equipment carries it out.
Public exposure measurements indicate why those controls are difficult to apply consistently. UK Cyber Defence research in October identified more than 800 refrigeration and building-control interfaces accessible on the public internet in Britain. Bridewell’s more recent analysis, Riley said, found over 6,000 refrigeration management panels from a single manufacturer visible worldwide; that wider figure remains attributed to the company’s research.
Some controllers are old enough that software updates or manufacturer support may no longer be available. Others have patches but remain connected without adequate access restrictions, creating a gap between disclosure of a weakness and its removal from operational estates.
The EU Cyber Resilience Act adds product lifecycle security responsibilities for manufacturers of connected equipment. Relevant reporting duties began on 11 September 2026, while its principal product-security obligations apply from December 2027. The Act does not specifically mandate Lamplmair’s proposed command-validation architecture.
Operators retain responsibility for how equipment is connected and maintained, even as manufacturers face additional duties. The European incidents demonstrate the interaction between supplier access, internet exposure, physical processes, and food safety rather than a conventional theft of digital records.
Affected retailers have been assessing spoiled stock and restoring normal refrigeration. The investigations have not yet established a common perpetrator or a single confirmed exploitation method across all seven countries.
