A series of cyber-attacks recently targeted supermarket refrigeration systems across several European countries, including Belgium, Sweden, Luxembourg, and Ireland. The incidents forced retailers to discard millions of euros worth of spoiled food after hackers gained control over the units' temperature settings. In Sweden, one ICA store reported that its freezer temperatures were intentionally set to 50°C (122°F) overnight. Similar incidents were reported in Belgium, where a Delhaize branch in Hoeilaart estimated losing €100,000 in produce in a single location, excluding the additional costs associated with store closures.
The mechanism behind the attack involved the exploitation of software used to manage cold units remotely. According to reports on a previous similar incident in France, the targeted software was provided by the Danish engineering firm Danfoss. This software allows retailers to monitor and adjust refrigeration units from a distance, but hackers were able to use this access to force units to heat up rather than maintain freezing temperatures. The manufacturer, Danfoss, stated that the affected units were older models whose security software could not be updated to patch identified risks, despite the company having previously advised businesses to keep their systems current.
The image illustrates the real-world impact on retailers, specifically mentioning the ICA store in Sweden where temperatures were manipulated.
The consequences of these attacks extended beyond food waste to include physical hazards and significant logistical disruptions. In some French locations, managers arriving at stores in the morning were met with waves of hot air, and in some instances, small fires were reported. While the specific identity of the attackers remains unconfirmed by national cyber-security agencies, the incidents highlight a critical trade-off in industrial 'Internet of Things' (IoT) integration: the convenience of remote monitoring creates a massive attack surface, particularly when legacy hardware remains connected to the internet without the ability to receive modern security patches.