Thermostats Turned to 50C: Hackers Hit Supermarket Fridges Across Europe

By Olivia Hart

Thermostats on supermarket fridges and freezers in seven European countries were remotely cranked up in some cases to 50C (122F) in a fresh suspected cyber-attack — the second apparent incident in three weeks. The EU condemned what it called "a deliberate attempt to disrupt our food supply chain and undermine consumers' confidence in it".

Which supermarkets were affected?

The attack hit fridges in Belgian branches of Carrefour, Intermarché and Ikea. It also struck Coop and ICA in Sweden, Delhaize in Luxembourg, Kesko in Finland, SuperValu in Ireland and shops in Estonia.

The incident appeared to be a reprise of attacks three weeks ago, when anonymous hackers seized control of internet-exposed appliance management software. French retailers had to ditch huge amounts of food when their fridges suddenly overheated.

Something similar may have happened in the United States in early August, when a series of mysterious fridge malfunctions hit commissaries at at least six military bases. The Pentagon is investigating a suspected hack.

Security analysts fear a new front in cyber-attack tactics. Fridges are not unique in having exposed controls: many ovens, washing machines, dishwashers and central heating systems connect to the internet for remote access and automated control.

The takeaway: the attack surface extends well beyond one appliance category, and retail is proving it.

Who is doing it?

No politically motivated "hacktivist" group has claimed responsibility. No ransomware gang has exploited the vulnerability to demand payment either — which would in any event be difficult, because the damage is already done once the fridges overheat.

"The two most plausible attribution scenarios for me are some kind of state-based signalling and demonstration of capability or some kind of lone-wolf hacker that is conducting these attacks for their own personal reasons," said Rafe Pilling, senior director for threat intelligence at the cybersecurity company Sophos.

The state-linked actor theory seems most likely, in part because of the psychological impact on large populations of seeing food stripped from shelves. North Korea is believed to have been behind last week's Binance cryptocurrency heist. In the fridge attacks, hackers linked to Russia and China are also likely to be in the frame.

Western intelligence chiefs say Moscow is waging a campaign of sabotage in Europe that takes many forms and is likely to intensify in the coming months. That claim rests on intelligence assessments, not on attribution evidence in this specific case.

Attribution is made harder by the simplicity of the hack. No malware was needed, leaving no trace of a weapon at the scene. Pilling compared it to "wearing rubber gloves and messing with the switches".

In plain words: the most alarming theory — state signalling — is also the least provable with current evidence.

How is it possible?

The software that manages commercial fridges is connected to the internet, which means lines of code can be left vulnerable. Unlike desktop or mobile devices, where users receive alerts to install security patches, fridge software can go long periods without updates.

Nick Jackson, director of cyber-operations at the cybersecurity company Bitdefender, said one reason companies move slowly on patches is that they can take time to run, leaving machinery offline — an obvious problem for food retailers. A simpler explanation, he said, could be that the people running the fridges are simply not aware of the problem: they "don't think about that and it's not top of their agenda".

In Monday's wave of incidents, Coop in Sweden said some of its fridges were linked to a 4G mobile network that made them more exposed. ICA said its system was provided by Danfoss, the Danish company that had problems in France.

What can shops do to defend themselves?

The simple answer is to patch their software systems. According to the Belgian refrigerator group Sabcobel, the impact of Monday's hack could have been far worse if it had not started patching fridges after the 12 October attack in France.

The UK, which has not yet been affected, is taking precautionary steps. Retailers are "currently working with the National Cyber Security Centre to ensure their fridges and freezers are secure as possible against potential attacks", said Graham Wynn, assistant director of regulatory affairs at the British Retail Consortium.

Why have British supermarkets not been hit yet?

Internet-exposed refrigeration systems are most popular in countries including France, Italy, Greece and Belgium, according to the cybersecurity company Forescout.

"When we checked the data for these exposed systems online of supermarkets, the UK is not in the top 10," said Daniel dos Santos, Forescout's vice president of research. He said the risk was not negligible, but "I wouldn't say it's super-high right now for the UK specifically".

A spokesperson for the NCSC said it was "working with its international partners and industry to fully understand details of an incident".

For now, no culprit has been named and no arrest has been reported. That leaves patched software as the only defence retailers demonstrably control — and, as Sabcobel's experience shows, it measurably limits the damage.