During the night between Sunday 1st and Monday 2nd November, problems occurred with the refrigerators and freezers of several supermarkets located in Belgium, Sweden, Luxembourg and Estonia: the systems recorded anomalous increases in temperature (with reports reaching up to 50°C), putting food preservation at risk. In some stores it was necessary to throw away some of the products. Several incidents have been attributed to cyber attacks on refrigeration systems, but it is not yet established that they are all connected.
A similar case had already been found in October, when hackers hit the refrigerators of numerous French supermarkets. The risk also concerns Italy, so much so that the National Cybersecurity Agency (ACN) has published an alert with the measures to be adopted to protect plants and prevent similar incidents.
What’s happening to European supermarkets
In Belgium, the Delhaize chain confirmed a cyber incident affecting the refrigeration systems of around 40 stores, stating that it had taken measures to keep them operational. The anomalies also affected at least 15 Carrefour supermarkets, around fifteen Intermarché and 5 Spar stores. Some supermarkets of the group were also involved in Luxembourg.
In Estonia, however, a cyber attack hit a Selver supermarket chain, where hackers managed to change the temperature settings of a freezer. According to the company, the rapid intervention of the technicians made it possible to avoid damage to the food.
Also in Belgium, the temperatures of refrigerators and especially freezers have risen to around 15°C in several stores, compromising the preservation of food. The manager of a Delhaize supermarket said he found the systems in defrost mode during the night and was forced to throw away fresh and frozen products.
In Sweden, the ICA and Coop chains have reported similar problems. An ICA outlet attributed the incident to a hacker attack, claiming that refrigerator and freezer settings had been turned to 50°C. Sweden’s national cybersecurity center is investigating reports in the country.
How hackers can change the temperature of refrigerators
In supermarkets, refrigerated counters and cold rooms can be connected to electronic control units that manage the temperature, signal any faults and allow maintenance workers to intervene even remotely. These systems fall within the scope ofOperational Technology (OT), i.e. technologies used to control equipment and physical processes.
Remote access facilitates maintenance, but can become a weak point if a control interface is exposed to the Internet without adequate protections. Anyone who manages to access the system without authorization can, depending on the available functions, modify the operating parameters, for example those of the automatic defrost, the procedure that eliminates the ice accumulated in the system by temporarily interrupting cooling and, in some models, using heat. If this cycle is prolonged unduly, the products risk deteriorating.
In the French case, the attackers had extended the defrost cycles from one hour to eight hours, delaying the activation of the alarms and, consequently, the intervention of the staff. After those incidents, CERT-FR, the French cyber incident response centre, confirmed numerous compromises of Danfoss controllers and Copeland and Dixell systems. However, it is not yet established that the events of November 2nd exploited the same attack equipment or methods.
Can it happen in Italy too? How to protect supermarkets and the cold supply chain
Similar attacks are also possible in Italy, where large-scale retail trade uses refrigeration systems that can be monitored and managed remotely. However, this does not mean that every supermarket is vulnerable: the risk depends above all on how the devices are configured, who can access them and the presence of updates and security measures.
On 13 October, following the French events, the ACN published a bulletin with urgent verification and mitigation measures aimed at large-scale retail trade, food logistics, industrial refrigeration and maintenance companies. The alert did not concern an attack already confirmed in Italy, but the need to prevent similar incidents.
The first recommendation is to check which control units and remote assistance services can be reached from the Internet and eliminate direct exposure of the control interfaces. When technicians need to connect remotely, it is best to use secure networks or enterprise-grade VPNs, with limited access to necessary equipment and multi-factor authentication. Default or shared passwords should also be replaced, and unused accounts should be disabled.
Another measure consists in separating the network that manages the systems from that used for the supermarket’s normal IT activities. This way, a problem affecting computers or business services is less likely to spread to refrigeration equipment. You should also check available updates and plan to replace obsolete devices that no longer receive security fixes, without uncontrollably interrupting refrigeration.
Prevention, however, does not depend only on the individual point of sale. According to the ACN, IT managers, plant managers and maintenance workers must coordinate the checks and also check connections with external suppliers and platforms that administer multiple stores. If a single console allows you to change the settings of numerous supermarkets, a compromise could impact multiple locations. This is why it is important to limit access privileges, record interventions and prevent an account authorized for one store from reaching all the others indiscriminately.
Finally, it’s not enough to check that the refrigerator is turned on. Monitoring must concern actual temperatures, defrost cycles, alarm thresholds and notifications, possibly also using tools independent of the supervision system. If anomalies emerge, the staff must be able to promptly involve the technicians, secure the systems and evaluate the condition of the food. In case of suspected compromise, the ACN also recommends promptly reporting the incident to CSIRT Italy, the national structure that deals with the response to IT incidents, through institutional channels.
