A fresh wave of cyberattacks targeting supermarket refrigeration systems has raised serious questions about the security of connected cooling equipment, with retailers and food businesses across Europe reporting disruption.
Supermarket refrigerators and freezers have once again become targets for hackers, with attacks reported across several European countries, just weeks after a similar incident affected hundreds of French supermarkets.
The latest incidents, which began around November 2, have affected businesses in Belgium, Luxembourg, Sweden, the Netherlands, Ireland, Estonia and Germany. Both Danfoss and Copeland refrigeration control systems have been implicated.
The attacks involve remotely manipulating refrigeration controllers and switching equipment into defrost mode, causing temperatures to rise and putting chilled and frozen food stocks at risk.
In some cases, temperatures reportedly reached 50°C, forcing retailers to remove products from sale and discard affected stock.
UK businesses also affected
The problem is not confined to major supermarket chains.
The UK’s National Cyber Security Centre (NCSC) has confirmed that a small number of UK organisations may have been affected by vulnerabilities in their systems.
Among those reporting an incident is London-based fresh food wholesaler Langridge Organic, which said six of its ten cold-room control systems had been compromised.
The attackers were able to manipulate refrigeration settings and disable automatic temperature warning messages. However, regular manual temperature checks helped the business avoid losing stock.
Several UK meat processors have also reported problems.
Danfoss and Copeland systems under scrutiny
Danfoss controllers have featured prominently in the incidents, alongside Copeland equipment in Belgium.
According to Danfoss, some of the systems targeted in the Netherlands were directly accessible over the internet and still using default passwords, despite earlier warnings to customers.
The latest attacks follow an incident in France in October, when around 700 supermarkets were reportedly affected.
That incident prompted manufacturers and cybersecurity authorities to warn businesses about exposed refrigeration controllers, outdated software and inadequate security arrangements.
However, the latest wave suggests that not all operators have acted on those warnings.
A wider challenge for the refrigeration industry
The incidents highlight a growing vulnerability in the increasingly connected commercial refrigeration market.
Remote monitoring and management allow retailers, service engineers and refrigeration contractors to check temperatures, adjust settings and identify faults without visiting individual stores.
However, connecting equipment to external networks also creates potential security risks if systems are not properly protected and maintained.
Older controllers that no longer receive security updates present an additional challenge, particularly where retailers and contractors are unaware of the equipment’s exposure.
What happens next?
Manufacturers, retailers and refrigeration contractors face renewed pressure to review the security of connected equipment.
Recommendations include removing direct public internet access to refrigeration controllers, using secure remote connections, replacing default passwords, installing available software updates and reviewing older equipment that no longer receives security support.
The incidents also underline the importance of having independent temperature monitoring and contingency procedures in place should automated systems become unavailable or compromised.
With refrigeration playing a critical role in food retail, the latest attacks demonstrate that cybersecurity is no longer simply an IT issue. It is an operational risk for the entire commercial refrigeration supply chain.
The identity of those responsible remains unconfirmed, and investigators have not established whether the October and November incidents were carried out by the same attackers.
