Frozen part II: Hackers remotely defrost produce in Euro supermarkets ... again

Grocery stores now face increased operational costs and supply chain disruptions from preventable cyberattacks.

Dozens of European supermarkets in Belgium, Ireland, Luxembourg, and Sweden have reported significant food spoilage due to cyberattacks. Hackers remotely manipulated commercial refrigerators and freezers, setting them to defrost mode and raising temperatures to as high as 50°C. In Belgium, approximately 40 Delhaize stores experienced a "catastrophic" loss of fresh and frozen products, forcing them to discard all affected merchandise. Around 15 Carrefour stores and sites operated by Intermarché, Spar, and Shop & Go also reported similar issues. Swedish chain ICA confirmed attacks impacting a "small number of stores," with one location reporting no fresh or frozen produce available. Six Coop stores in central Sweden and at least 13 SuperValue stores in Ireland also experienced fridge-freezer problems. These incidents follow similar attacks on French grocery chains in mid-October, which affected hundreds of stores, some of which were found to be running outdated firmware on refrigeration controllers.

The repeated targeting of refrigeration systems in European supermarkets indicates a vulnerability in the operational technology (OT) sector of the retail industry. Attackers are exploiting accessible control systems, potentially through unpatched firmware or weak network security, to cause physical disruption and financial loss. This trend suggests a growing sophistication in cybercrime tactics, moving beyond data theft to direct physical impact on essential services and supply chains.

Retailers must urgently reassess their OT security, investing in robust monitoring, patching protocols for embedded systems, and network segmentation to isolate critical infrastructure. The incidents highlight a critical need for manufacturers to prioritize security in IoT and OT device design, and for regulatory bodies to establish clearer security standards for these interconnected systems.