Europe's Supermarket Freezers Under Cyberattack: Food Spoiled, Millions Lost

Supermarket refrigerators and freezers across Europe have been the target of a sophisticated cyberattack, causing significant food spoilage and damage to internet-connected cooling units. On Monday, refrigeration units in over 100 shops across several European countries experienced temperature fluctuations, leading to the destruction of large quantities of food. These cyberattacks on supermarkets began last month, with hundreds of French supermarkets previously affected, resulting in spoiled food and damaged units due to overheating, with estimated costs running into millions of euros.

The motive behind these attacks remains unclear, but the scope has expanded across the continent and even reached the United States. Several European countries have reported incidents. In Belgium and Luxembourg, dozens of Delhaize shops were affected by an "IT incident." French retailer Carrefour reported refrigeration problems at approximately 15 of its 700 Belgian locations. The Colruyt group confirmed that five of its Spar stores were impacted. In Sweden, cooling systems at seven of Coop's 800 stores experienced disruptions, ranging from complete shutdowns to partial operation. Swedish furniture retailer IKEA noted one site in Mons, Belgium, was affected. The Belgian butchery chain De Laet & Van Haver reported temperatures rising to 18 degrees Celsius in its fridges, ruining meat valued at around 15,000 euros. In Ireland, food wholesaler Musgrave reported that a cyber-incident affected refrigeration systems in 13 of its SuperValu stores.

In October, French supermarkets faced similar cyberattacks, leading to the spoilage of tonnes of food, fires, and melting of refrigeration unit components.

In the United States, incidents were reported in August. Freezers at a market in Fort Huachuca, an Army base in Arizona, were put into defrost mode, spoiling all contained frozen food. The naval station in Newport, Rhode Island, also reported its refrigeration system was affected, leaving only dry goods available. The Pentagon is investigating these freezer malfunctions on military bases as suspected hacks, with officials reportedly communicating with French authorities regarding the issue.

Hackers are reportedly targeting internet-connected refrigeration systems by accessing their controls and raising temperatures to spoil frozen food. In some European supermarkets, temperatures were allegedly increased to as high as 50C (122F), causing units to melt or catch fire. Professor Awais Rashid of the University of Bristol explained that many remotely managed supermarket refrigeration systems, often handled by third parties, lack necessary software updates. He noted that these systems are often accessible on the internet without secure network management, and some controllers have known vulnerabilities, including easily guessable passwords.

The motive for these attacks is not definitively known, but authorities suspect a deliberate attempt to disrupt food supplies. Christophe Hansen, the European Commissioner for Agriculture and Food, stated that the attacks are a "deliberate attempt to disrupt" the bloc’s food supply and undermine consumer confidence, though he added that food security is not currently at risk, the food waste and business impact are significant. Rashid suggested that disruption is the likely motive, impacting both supermarkets financially and societal trust in critical infrastructure.

Belgium’s prosecutor’s office has launched a criminal investigation into the recent attacks, but no group has claimed responsibility. Theories have emerged linking state actors to cyberattacks, with North Korea recently accused in a major cryptocurrency heist. European intelligence officials have also warned of escalating Russian cyber warfare activities. The UK's National Cyber Security Centre has cautioned that Britain should prepare for AI-powered cyberattacks on critical national infrastructure within the next two years, with Russia, China, and other nation-states expected to use AI for geopolitical goals. This warning comes as the UK encourages citizens to stockpile essentials for potential emergencies. Rashid emphasized that as infrastructure becomes more digitized, the risk of disruption to cyber-physical systems like refrigeration increases, but also noted that effective cybersecurity practices ensure the safe operation of most digital infrastructures daily.