Brussels convenes ENISA and Europol task force after freezer attacks

Cold-chain failures are a food-safety problem before they are an IT problem. A freezer pushed to 50C means stock is thrown out and food inspectors get involved, not just helpdesks. Retailers in Belgium, Sweden, Finland, Ireland and Estonia now know their fridges are an attack surface. Brussels has moved from watching to convening. No one has publicly named those responsible.

What regulators did on 3 November

The Hacker News reported that attackers remotely changed settings on refrigeration controls at supermarkets in Belgium, Sweden, Estonia and other European countries. The changes came overnight into Monday, 2 November. The report said some stores had to throw away chilled and frozen food. The Commission said it was in direct contact with national authorities.

In the UK, the National Cyber Security Centre said it was working with affected companies. It described the national impact as minimal. Paul Chichester, the NCSC's director of operations, spoke on Tuesday.

"We're aware of those incidents in the UK, and obviously we're working with the affected organisations," Chichester said. "We'll keep monitoring that. At the moment, the impact is minimal."

So far, no UK grocery chain has suffered direct effects. The British Association of Independent Meat Suppliers said some of its more than 300 members had taken a "collateral" hit in the hack.

Danfoss, a Danish maker of refrigeration controls, said its products played a part. They also played a part three weeks earlier, when attackers hit hundreds of French supermarkets. No one had claimed the attacks by Monday night. It was unclear whether they were linked to the attack in France.

The pattern: France first, then Belgium and Sweden

Retailers in Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands and Sweden reported problems with refrigeration systems on Monday. Some temperatures rose to as high as 50C (122F). Ahold Delhaize said dozens of Delhaize stores in Belgium and Luxembourg were affected and food had to be discarded. The company says stores are fully operational again. IKEA told CNBC that a cyber incident affected refrigerators and freezers at its Mons store in Belgium between Sunday and Monday.

Carrefour told the BBC that attackers hit 15 of its Belgian stores. Intermarché said attackers hit 15 of its 153 Belgian stores. Colruyt reported that attackers targeted five Spar stores.

Sabcobel, a Belgian refrigeration fitter, estimated that the attack affected at least 20 units across the country, Belga News Agency reported. An ICA store in Sjöbo, in southern Sweden, said its fridges and freezers had been set to 50C. Staff were throwing out the affected goods.

Attackers targeted hundreds of French supermarkets in October. The attack caused fires, overheated fridges and spoiled food. Les Mousquetaires, which owns Intermarché, said at the time it expected damages of several million euros.

Why fridges are the soft target

The October attack on French fridges involved legacy technology connected to the internet with default passwords. Hackers remotely activated the built-in defrost mode. That overrode the temperature and the time spent defrosting, the exact same method as the France attack, according to Tom's Hardware. In other cases, attackers simply raised the temperature setting.

Sabcobel chief executive Stephan Moelans said the units need physical modifications. He said switching them to a secure internet connection is the simplest fix in the meantime.

Alex Pearce, managing director of the London wholesaler Langridge Organic, stopped the attack by pulling the internet connection to his cold storage units out at the wall. Pearce said the hackers had changed the parameters on a number of units. They set them to defrost for more than four hours at 150C. One meat supply company saw its cold units rise to up to 100C. Another two reported their units had started to defrost.

The wider warning

Richard Horne, the NCSC's chief executive, called the fridge attacks the "foothills" of an enlarged cyberthreat. Chichester said the attacks were not AI-enabled. He said they used vulnerabilities that had been out there for a long period of time.

Ollie Whitehouse, the NCSC's chief technology officer, said manufacturers need encouragement to make connected devices safer. He said consumers need to accept paying more for safer equipment.

Christophe Hansen, the European Commissioner for Agriculture and Food, said on X in October that "Food security requires more attention at all levels because the weaponization of food has become a reality". Commissaries at six US military bases suffered freezer malfunctions in late August. The Pentagon now treats those as a suspected hack and is coordinating with French authorities, Reuters reported.