Hackers Target Supermarket Fridges in Europe, Research Shows Vulnerability

A wave of cyberattacks targeting supermarket refrigeration systems across Europe has forced stores to discard large quantities of food, while new research reveals nearly 13,000 such systems are publicly accessible online. The attacks highlight the growing vulnerability of internet-connected cooling equipment used not only in retail but also in hospitals, farms, and food production facilities.

In Belgium, around 40 Delhaize supermarkets, at least 15 Carrefour stores, five Spar shops, and the butcher group De Laet en Van Haver were hit. Temperatures in fridges reportedly rose as high as 70°C, leading to food spoilage worth approximately €100,000. A spokesperson for Delhaize confirmed an "IT incident" affecting refrigeration systems, while problems were also reported at several Swedish ICA stores. These events follow a similar attack on 12 October, when hackers manipulated cooling systems in hundreds of French supermarkets.

New research from cybersecurity firm Forescout, published in October, found 12,976 refrigeration management systems exposed on 6,017 internet addresses across 99 countries and territories. Most belong to two product groups: Copeland and Dixell XWEB (7,075) and Danfoss StoreView (4,697). Alarmingly, 80% of Danfoss systems were running firmware older than the version that fixes known security flaws, and one controller has lacked manufacturer support since May 2021, leaving it without security updates.

These systems are connected to the internet to allow remote diagnostics and monitoring. According to Danfoss, such connectivity can reduce unnecessary service visits by 15–30% and enables automatic temperature logging required by food safety regulations. However, Forescout warns that responsibility for securing these devices is often split between service companies, store owners, and IT departments, so no single party may be aware of the external exposure.

The risk goes far beyond supermarkets. The same systems are used in the food industry, wineries, fruit warehouses, and farms. Attackers do not need sophisticated malware; once inside, they can use normal system functions to change temperatures, trigger defrost cycles, or disable alarms, making tampering hard to detect. Forescout recommends removing refrigeration management systems from the public internet, using secure remote access tools, replacing unsupported equipment, and eliminating shared passwords used by service companies. While the research does not specify whether Croatian businesses are among those exposed, experts advise all operators of such systems to review their cybersecurity posture.