Supermarket fridge attacks reach UK food suppliers as Europe counts the damage

Refrigeration controllers are ordinary internet-connected computers. Outside contractors often maintain them remotely. That makes the attacks matter to retailers, suppliers and regulators. A default password or an unpatched unit can spoil stock, force restocking and test emergency response across borders.

UK suppliers drawn into a European campaign

Paul Chichester is the National Cyber Security Centre's director of operations. He spoke at the launch of the agency's annual review on Tuesday.

The Guardian reported that no UK grocery chain has suffered direct effects so far. The damage landed further up the supply chain instead. The British Association of Independent Meat Suppliers represents more than 300 members. It said some members became "collateral" in the hack and suffered effects, and that they lost no meat.

Two other meat suppliers reported their units had started to defrost. The association said the affected units were empty at the time. A fruit and vegetable wholesaler in London stopped the attack. It pulled the internet connection to its cold storage units out at the wall. Alex Pearce is managing director of Langridge Organic. He said hackers had set a number of units to defrost for more than four hours. He and his staff intervened before any stock could suffer damage.

"It clearly must have been easy to get in [to the system] because the simple solution was to unplug ourselves from the internet," Pearce said.

Why refrigeration controls are the weak point

Refrigeration controls often connect to the internet so contractors can monitor them and fix faults remotely.

In Belgium, attackers switched cooling units into defrost mode, Stephan Moelans told Belgian media. He is chief executive of the refrigeration contractor Sabcobel. Defrost mode should clear ice. Here it made the units heat up instead of keeping food cold.

A Danfoss spokesperson told NOS that the Dutch systems hit by the attack were not on a secure network. They still used default passwords. The same pattern showed up in France last month. There the attack on supermarket fridges involved legacy technology connected to the internet with default passwords. Danfoss products featured in the latest incidents. They also featured three weeks earlier when attackers hit hundreds of French supermarkets. Danfoss is not the only maker in the frame. An affected Belgian butcher told NOS that attackers also hit equipment from Copeland in Belgium.

Seven countries, dozens of stores

Retailers in Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands and Sweden reported problems with refrigeration systems on Monday. Temperatures rose as high as 50C (122F). Not every unit behaved the same way. At a Selver supermarket in Estonia, a freezer was set to 50C but rose only about 2-3C. Jann Mutso of the refrigeration supplier Kitman Coldtech said the problem was fixed in about 10 minutes and no products suffered damage.

Ahold Delhaize said the attacks affected dozens of its Delhaize stores in Belgium and Luxembourg. It said food had to be discarded and that stores were fully operational again. Carrefour reported disruption in about 15 of its 700 Belgian shops. Intermarché said the attacks hit 15 of its 153 Belgian stores. Colruyt said attackers targeted five of its Spar stores in Belgium. ICA in Sweden confirmed an incident at a limited number of stores. Kesko in Finland and SuperValu in Ireland also reported refrigeration disruptions.

At a De Laet & Van Haver butcher shop in Hove, south of Antwerp, fridges were turned up to 18C. The owner, Luc De Laet, estimated about €15,000 of meat went bad. Musgrave took chilled and frozen products off sale at 13 SuperValu stores as a precaution. It said on Monday afternoon that the incident had ended. For scale, the October campaign in France caused food losses estimated in the tens of millions of euros.

What regulators know, and what they do not

The European Commission said it was in direct contact with national authorities. It convened a meeting of the EU interinstitutional Task Force with ENISA and Europol on Tuesday morning. EU food and agriculture commissioner Christophe Hansen called the repeated attacks a deliberate attempt to disrupt the food supply chain. He said they aimed to undermine consumer confidence in it.

John Billow, head of Sweden's national cybersecurity centre, told Reuters the country had "quite a lot of exposed operational technology devices" that needed updating or patching. The NCSC said the fridge attacks themselves were not AI-enabled. It said they used vulnerabilities that had been out there for a long period of time.

Danfoss's security advisories page listed no advisory about the attacks on November 3. The most detailed steps for operators are still those in an October alert from CERT-FR, part of France's national cybersecurity agency. No one had claimed the attacks by Monday night. No one knew whether they had a link to the attack in France.