Hackers hit supermarket fridges across Europe, and the EU is coordinating the response

Some units reached 50C (122F). Retailers in Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands and Sweden reported refrigeration problems on Monday.

Shoppers found empty chilled shelves and discarded stock. Retailers face a physical and digital fix: cooling gear put online now needs securing or replacing. Nobody has publicly attributed the attacks, and the total number of stores hit across Europe is still unclear.

Ahold Delhaize said dozens of its stores had a refrigeration incident on Monday and food had to be discarded. The Dutch supermarket giant said stores are fully operational again.

Carrefour told the BBC that 15 of its Belgian stores were attacked. Intermarché said 15 of its 153 Belgian stores were hit, and Colruyt Group said five of its Spar stores in Belgium were targeted, according to Reuters. That is roughly one in ten of Intermarché's Belgian estate.

IKEA said a cyber incident affected refrigerators and freezers at its Mons store in Belgium between Sunday and Monday. It is inspecting affected equipment and products and checking installations at its other Belgian stores. Belga News Agency reported the Belgian attack began around midnight on Sunday. Refrigeration fitter Sabcobel estimated at least twenty units were affected. Belga News Agency said Delhaize was among affected Belgian chains. ICA, Sweden's biggest grocery retailer, said a limited number of stores were affected on networks outside its central systems. Finnish Kesko, Irish chain Supervalu and Estonian grocer One Selver also reported disruptions.

Why a fridge is a health story

Hackers raised temperatures in online-controlled freezers to 50 degrees Celsius. Contents defrosted rapidly, and the attack likely destroyed millions of dollars of goods.

That is a food-safety problem, not an IT outage. The British Association of Independent Meat Suppliers, which has more than 300 members, said some were affected as "collateral" but no meat was lost because the units were empty. One meat supply company saw cold units rise to up to 100C, while two others reported units starting to defrost. The association said the incidents showed food businesses at any point in the supply chain may be targets.

The European Commission is in direct contact with national authorities. It convened the task force with ENISA and Europol on Tuesday morning. The task force includes ENISA, Europol and relevant Commission services.

How the intruders got in

The October attack on French supermarket fridges involved legacy technology connected to the internet with default passwords. Hackers remotely activated the freezer's built-in defrost mode, overriding temperature and time settings, the same method used in France.

Alex Pearce, managing director of Langridge Organic in London, said hackers set units to defrost for more than four hours at 150C. His staff stopped it by pulling the internet connection at the wall. Pearce said Langridge uses the same fridge control system, made by US software company Copeland, that was involved in the earlier incidents.

Sabcobel CEO Stephan Moelans said physical modifications to the units are required. Switching to a secure internet connection is the simplest interim fix, he said. That makes the fix physical, not a software patch. Sabcobel said most of its customers had already switched units to a secure internet connection after the France attack.

The October precedent

Hundreds of French supermarkets were targeted in October in an attack that caused fires, fridges to overheat and food to spoil. Intermarché owner Les Mousquetaires said at the time it expected damages of several million euros.

Intermarché said a few stores suffered stock losses this week. It said the damage was nothing comparable to the mid-October attack.

"The weaponization of food has become a reality," European Commissioner for Agriculture and Food Christophe Hansen said in October.

What regulators say now

Paul Chichester, director of operations at the UK's National Cyber Security Centre, said the UK impact was minimal. He said the attacks were not AI-enabled and used vulnerabilities "out there for a long period of time". The NCSC is part of GCHQ, the UK spy agency. Chichester said the NCSC was working with organisations to find and close loopholes before hackers exploited them. The NCSC launched its annual review on Tuesday.

NCSC chief executive Richard Horne called the fridge attacks the "foothills" of a larger cyberthreat. Horne said many vulnerabilities could be waiting to be exploited. NCSC chief technology officer Ollie Whitehouse said manufacturers need to be pushed to make connected devices safer. Whitehouse said everyday domestic devices connected to the internet would be susceptible in some situations. Consumers should accept paying more for safer equipment, he said.

No UK grocery chain has been directly affected, the Guardian says. The Hacker News reported a second wave of refrigeration cyberattacks across Europe, forcing stores to pull food.