Hackers heat supermarket freezers across Europe as UK suppliers report attacks

Hackers turned supermarket fridges and freezers into heaters across at least seven European countries overnight into Monday, and by Tuesday the UK's cyber agency was dealing with attacks on British food suppliers too.

Paul Chichester, director of operations at the National Cyber Security Centre, said the agency was working with the affected companies. "At the moment, the impact is minimal," he said at the launch of the NCSC's annual review on Tuesday.

The damage so far is measured in discarded stock rather than empty shelves: a few dozen stores lost chilled and frozen food, and most stayed open. What the incidents show is how much of a supermarket runs on small internet-connected controllers that customers never see. Refrigeration units are wired up so contractors can watch them and fix faults remotely, and that convenience is the exposure. No one has said who is behind the attacks, and it is not yet established whether they were coordinated.

Retailers in Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden reported problems with refrigeration systems on Monday, the Guardian reported, with some units reaching 50C (122F).

BleepingComputer counted more than 115 affected stores across Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia, based on statements from the chains.

Ahold Delhaize, the Dutch group that owns Delhaize, said refrigeration systems at several dozen stores in Belgium and a few in Luxembourg were hit; BleepingComputer put the figure at around 40 locations. The company called it an IT incident, said food had to be discarded, and told CNBC that stores were fully operational again. Carrefour said 15 of its more than 700 Belgian stores were affected, in Flanders and Wallonia, and that no hypermarket was among them.

Intermarché told CNBC that 15 of its 153 Belgian stores were hit. The Hacker News put the range at 10 to 15, citing the company. An Intermarché spokesperson said security measures contained most of the attempts, adding that a few stores "did suffer some stock losses, although nothing comparable to the attack in mid-October."

IKEA said a cyber incident affected fridges and freezers at its Mons store in Belgium between Sunday and Monday. The store stayed open, and the company said the impact on its restaurant and Swedish Food Market was limited.

In Sweden, ICA confirmed an incident at "a limited number of stores" that sit outside its central network. Coop, one of the country's largest chains, told BleepingComputer that 7 of its more than 800 stores were affected overnight into Monday; The Hacker News noted that Coop gave a figure of 6 to TT and AFP and 7 to Reuters and Bloomberg. "The issues have ranged from completely shut-down refrigerators and freezers to partially functioning units, and in one case, the system beginning to generate heat," Coop said.

Finland's Kesko reported unusual temperatures at a few smaller stores. Irish chain SuperValu, owned by Musgrave, counted 13 of its 223 stores, limited to one refrigeration model. In the Netherlands, at least 17 butchers and small local shops were hit, according to The Hacker News.

Estonia's Selver had one store affected through its refrigeration supplier Kitman Coldtech. Jann Mutso, the supplier's chief executive, told The Hacker News that a freezer was set to 50C, that the temperature rose by only about 2-3C, and that the problem was fixed in roughly 10 minutes with no products damaged.

Not every case produced a spoilage story. An ICA store in Sjöbo, in southern Sweden, said its fridges and freezers had been set to 50C and that staff were throwing out the affected goods.

The method was blunt. In Belgium, attackers switched cooling units into defrost mode, Stephan Moelans, chief executive of the refrigeration contractor Sabcobel, told Belgian media. Defrost mode is meant to clear ice, but in these attacks it made the units heat up instead of keeping food cold. Sabcobel manages refrigeration systems for Delhaize. In other cases, the temperature setting was simply raised.

Danfoss, the Danish maker of refrigeration controls, said its products were involved, as they were three weeks earlier when attackers hit hundreds of French supermarkets. That earlier campaign is the reason the retail industry was watching its thermometers at all: the Guardian reported that the French attack involved legacy technology connected to the internet with default passwords.

Danfoss's security advisories page listed no advisory about the attacks when The Hacker News checked on 3 November. The most detailed guidance for operators remains an October alert from CERT-FR, part of France's national cybersecurity agency.

In the UK, the British Association of Independent Meat Suppliers said some of its more than 300 members were affected after becoming "collateral" in the hack. The body said no meat was lost in the refrigeration incidents, but called them a reminder that businesses anywhere in the food supply chain may be seen as targets. One meat supply company saw its cold units rise to up to 100C (212F), while two others reported units starting to defrost. The association said the affected units were empty at the time.

A fruit and vegetable wholesaler in London stopped the attack from escalating by pulling the internet connection to its cold storage units out at the wall. Alex Pearce, managing director of Langridge Organic, said the hackers had changed parameters on a number of units, setting them to defrost for more than four hours at 150C.

Chichester said the NCSC was working with organisations to find loopholes and close them before hackers exploited them. He said the agency could not comment on who might have carried out the attacks, but that they were not AI-enabled and had used vulnerabilities that had been "out there for a long period of time".

Richard Horne, the NCSC's chief executive, described the fridge attacks as the "foothills" of a larger cyberthreat facing companies and the public, as AI systems highlight flaws in networks that owners have not patched. "There are so many vulnerabilities out there that … you could say are waiting to be exploited," he said.

Ollie Whitehouse, the agency's chief technology officer, said everyday domestic devices connected to the internet would be susceptible in certain situations. Manufacturers needed encouragement to make their technology safer, he said, and consumers needed to accept paying more for safer equipment.

The European Commission is in direct contact with national authorities and convened a meeting on Tuesday morning of its interinstitutional Task Force with EU agencies ENISA and Europol, a spokesperson told CNBC.

What remains open is attribution and scale. No one had claimed the attacks by Monday night, and it was not known whether they were linked to the French campaign. Each company described the incident in its own words, and not all of them called it a cyberattack.