分类： technology

A previously unreported wave of recent cyber-intrusions targeting internet-connected refrigeration units in Europe has expanded beyond the initially known supermarket sector, French health authorities confirmed this week. Operators of the French Blood Establishment (EFS) revealed that regulated cold storage rooms holding life-saving donated blood supplies were among the compromised systems, where unidentified threat actors attempted to raise internal temperatures to ruin critical blood products. Rapid, proactive intervention by on-site EFS staff prevented any loss of blood inventory, and health officials have verified zero adverse impacts on patient safety to date. Prior to this disclosure, public awareness of the hack campaign was limited exclusively to disruptions affecting European grocery chain freezer units.

Unsubstantiated online claims have circulated linking the attacks to two Russia-affiliated hacktivist collectives, NoName057(16) and the Z-Pentest Alliance, which posted statements claiming responsibility for breaching systems manufactured by industrial control firm Danfoss, a leading supplier of refrigeration management components. However, independent cybersecurity analysts have cast significant doubt on these assertions, noting that NoName057(16) has a well-documented history of claiming credit for operations it did not execute, and its demonstrated technical capabilities are largely limited to basic distributed denial-of-service (DDoS) traffic flooding attacks, rather than the targeted industrial system intrusions seen in this campaign.

To trace the origin and tactics of the threat actors, three separate cybersecurity firms have deployed specialized digital decoy tools known as “honeypots” across global networks: fake, intentionally vulnerable refrigeration management software instances designed to lure hackers into revealing their scanning patterns, access methods, and operational infrastructure. Teams from Spanish cybersecurity firm Previdian, Scotland-headquartered Lupovis, and French national cyber-defense provider Sekoia have all gathered actionable intelligence from these traps.

Evidence collected from the honeypots shows the second major wave of attacks was highly geographically targeted: Lupovis reported that its decoy systems located in Africa, South America, and even Ukraine received zero probing activity, while all scanning attempts were directed exclusively at European-based fake refrigeration units, starting 10 full days before the second round of intrusions was launched. Researchers confirmed that the targeted refrigeration control devices relied on poorly secured, publicly exposed software with widely documented, easily exploitable vulnerabilities that are openly shared on underground cybercriminal forums.

Ryan Dewhurst, a cybersecurity researcher at Previdian, emphasized that the simultaneous, overnight execution of temperature adjustments across dozens of unconnected facilities required significant pre-planning: actors had to first compile a complete list of public IP addresses for all targeted refrigeration units, coordinate access attempts across time zones, and schedule operations for off-hours to maximize potential product loss and operational disruption.

While investigators have not formally ruled out Russia-linked state actors or hacktivists, Sekoia’s public threat assessment notes that Iran-aligned hacking groups have a long, well-documented track record of targeting internet-connected industrial control systems, including a 2022 breach that compromised 40 Danfoss-managed supermarket refrigeration units in Israel, and a separate late-August 2024 incident that forced freezer systems at six U.S. military bases into full defrost mode. No technical evidence to date has confirmed Russian-speaking threat actors were behind the European refrigeration hacks, Sekoia officials confirmed to reporters.

Investigators also have not dismissed the possibility that a coordinated group of adolescent threat actors, or even unrelated copycat hacking teams, could be responsible for the different waves of intrusions. All three cybersecurity research teams noted that a sufficiently organized group with the required level of operational planning would almost certainly post public boasts of their activity on underground forums in the near future, if they had orchestrated the high-profile campaign. National law enforcement and cybersecurity agencies across multiple European countries have issued formal alerts to supermarket operators, medical facilities, and industrial sites to patch exposed refrigeration control systems and monitor for unusual temperature adjustments, as the investigation to formally identify the perpetrators remains ongoing.

A sweeping wave of coordinated cyber intrusions targeting grocery retail infrastructure unfolded across at least nine European nations on Monday, triggering widespread disruptions to remotely managed refrigeration and freezer systems that pushed internal temperatures as high as 50°C (122°F) and forced operators to discard massive volumes of perishable chilled and frozen stock. The incident has spurred EU authorities to raise urgent alarms over deliberate attempts to destabilize the bloc’s critical food supply chain, coming just three weeks after a separate cyberattack crippled operations at roughly 700 French grocery outlets, resulting in tens of millions of euros in estimated food waste losses.

Across affected jurisdictions spanning Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden, local law enforcement and cybersecurity agencies have launched formal investigations to identify the perpetrators, as no group has yet claimed responsibility for the coordinated intrusions. The string of attacks has amplified longstanding concerns over the vulnerability of internet-connected operational technology, including remote refrigeration monitoring tools, to state-backed hybrid warfare tactics that target civilian critical infrastructure to disrupt daily life without triggering conventional armed conflict.

EU Food and Agriculture Commissioner Christophe Hansen emphasized that the European Commission is treating the series of incidents with utmost gravity, issuing a public warning that additional disruptive cyber events targeting essential civilian services could occur in the near future. Commission spokesperson Thomas Regnier declined to assign formal blame for the attacks publicly, but noted the incidents serve as a stark reminder of how easily malicious cyber activity can upend core public services and directly impact ordinary residents. He stressed that EU member states must adopt a unified, proactive stance to build collective cyber resilience and prepare for comparable future threats.

National responses across the bloc have varied by the scale of local disruption. In Italy, Prime Minister Giorgia Meloni’s administration convened an emergency meeting with national intelligence leadership, noting that the immediate impact of the attacks remained very limited, as the vast majority of the country’s food distribution network runs on up-to-date cybersecurity systems capable of repelling such intrusions. Italy’s national cybersecurity agency confirmed that only four Co-op supermarket locations in Sicily and one retail outlet in Tuscany experienced disruptions, with the prime minister’s office disclosing that all affected sites relied on outdated, poorly secured systems with internet-exposed interfaces and insufficient identity verification protocols.

Belgium reported some of the most severe impacts, with dozens of supermarket locations facing total refrigeration failures, prompting federal prosecutors to open a full criminal investigation. Delhaize supermarket manager Mathieu Tilman expressed profound distress at the attack’s consequences, stating, “I cannot fathom why anyone would do this… It is deeply upsetting to see so much perfectly good food go to waste. Moments like this make you want to walk away from the job entirely.”

In Ireland, retail group Musgrave confirmed that 13 of its SuperValu locations were hit by the cyber incident, with a spokesperson noting that restocking of chilled and frozen product lines at affected outlets was already well underway by Monday. A small number of independent convenience stores in the Netherlands also reported minor operational disruptions, coming on the heels of a separate cyberattack on major Dutch supermarket chain Albert Heijn last month that forced the firm to take multiple in-store services offline. In Portugal, the Mosqueteiros group disclosed that disruptions at seven Intermarché locations were linked to the cyber campaign, which appeared to target a third-party external service provider that manages refrigeration system operations for multiple retail clients. Swedish grocery chain ICA acknowledged that a small subset of its stores experienced unusual refrigeration performance, stopping short of formally confirming a cyberattack, while Sweden’s national cybersecurity agency has launched ongoing monitoring of the situation. Finnish retail conglomerate Kesko reported abnormal temperature readings at a handful of its smaller grocery stores and is conducting internal investigations to trace the root cause, while Estonian public broadcaster ERR confirmed that at least one national supermarket location was hacked, with perpetrators deliberately raising refrigeration unit temperatures to 50°C.

Across the English Channel, the UK’s National Cyber Security Centre (NCSC) has issued an urgent advisory to all British food retailers, mandating immediate software updates for all remote fridge and freezer temperature control systems. NCSC director Richard Horne warned during an appearance on BBC Radio 4’s Today programme that the UK faces a high likelihood of an AI-powered cyberattack targeting critical national infrastructure within the next two years. Horne confirmed that the NCSC has already identified a small number of instances in the UK where vulnerable connected food supply chain technology has been exploited by malicious actors, and agency teams have been working around the clock to alert all organizations across the entire food distribution ecosystem that run exposed, unpatched systems at high risk of similar intrusions.

A wave of coordinated cyber intrusions targeting remotely managed commercial refrigeration systems has struck food retail and supply chain operations across multiple European nations this week, following a similar large-scale attack in France earlier this October. First reported on Monday, the latest incidents saw threat actors exploit publicly documented vulnerabilities in cold storage control hardware to override temperature settings, switching thousands of supermarket fridge and freezer units to defrost mode and rendering large volumes of perishable fresh and frozen stock unfit for sale.

Countries including Ireland, Sweden, Estonia, Belgium, the Netherlands and Finland confirmed cases of impacted retail locations, with roughly 40 Delhaize supermarket branches across Belgium and Luxembourg reporting disruptions. Belgian refrigeration manufacturer Sabcobel verified that the attacks forced the evaporator components of connected cooling units into defrost cycles, causing rapid, unplanned temperature spikes. The attack vector matches the modus operandi used in early October, when hundreds of French supermarkets were targeted in an overnight hack that destroyed millions of euros worth of food inventory.

In the United Kingdom, the National Cyber Security Centre (NCSC) disclosed that its teams worked through the overnight hours ahead of Tuesday to alert potentially at-risk food sector organisations, after identifying a small number of cases where unpatched, vulnerable refrigeration technology had been exposed to exploitation. No major stock losses have been confirmed in the UK to date, but industry groups have flagged that food supply chain operators across the country are at heightened risk. The British Association of Independent Meat Suppliers (AIMS), which represents more than 300 meat processing and distribution firms, confirmed some of its members had become unintended collateral targets of the ongoing campaign, though no member reported full loss of perishable meat stock.

AIMS head of communications Tony Goodger emphasized that the attacks serve as a critical wake-up call for every stakeholder across the food supply ecosystem, urging full industry vigilance to address unaddressed security gaps. NCSC chief executive Dr Richard Horne noted that it remains too early to attribute the attacks to a specific threat actor, but highlighted a systemic, industry-wide failure to invest in securing legacy operational technology that underpins critical daily services. Horne warned that many organisations continue to run outdated, end-of-life refrigeration and industrial control systems that are never disconnected from public internet networks or segmented into secure, isolated environments, creating easily exploitable “low-hanging fruit” for hackers. He added that the growing accessibility of generative AI tools for malicious actors is accelerating the speed and scale at which these unpatched vulnerabilities can be located and weaponized.

Horne called on all private sector operators to prioritize upgrades for ageing connected infrastructure, noting that while government cybersecurity agencies can provide guidance and intervention support, ultimate responsibility for protecting operational systems falls to the businesses themselves. The British Retail Consortium confirmed that major UK supermarket chains including Asda, Lidl, M&S, Sainsbury’s and Tesco are collaborating closely with the NCSC to audit and harden their refrigeration control systems against potential follow-on attacks, noting that retailers have already made substantial ongoing investments in cybersecurity frameworks.

For frontline food retailers, the human and economic cost of the attacks has been particularly acute. Mathieu Tilman, who operates an independent Delhaize franchise in Belgium, described the mass disposal of hundreds of thousands of euros worth of edible, recently spoiled food as deeply distressing, noting that widespread global food insecurity makes the unnecessary waste feel profoundly unethical, to the point he considered abandoning his business entirely in the immediate aftermath of the breach.

A wave of suspected cyber-intrusions targeting supermarket chains across Europe has disrupted operations of commercial refrigeration and freezer systems, sparking widespread alarms over unaddressed security gaps in internet-connected hardware spanning industrial machinery to common household smart appliances. The expanding ecosystem of internet-linked devices, ranging from smart refrigerators, central heating systems, and washing machines to large-scale industrial control units, offers users the convenience of remote monitoring and adjustment, but every network-connected endpoint represents a potential entry point for malicious cyber actors. While major consumer technology brands typically invest substantial resources to fortify their products against unauthorized access, past documented vulnerabilities have underscored persistent risks: as far back as 2015, cybersecurity researchers proved they could intercept unencrypted internet traffic through a flaw in a Samsung smart fridge model. Crucially, investigators have confirmed no evidence links the recent November supermarket cyber-attacks to targeted exploitation of domestic consumer smart appliances. Ciaran Martin, former chief executive of the UK’s National Cyber Security Centre (NCSC), emphasized that device manufacturers bear greater responsibility for embedding robust security safeguards at the product design stage. “We need to demand far more accountability from large technology firms to deliver inherently secure devices and products from the outset,” Martin stated, while urging ordinary consumers to prioritize regular software updates and enable multi-factor authentication on all connected devices where available. “It may feel like a minor hassle, but these steps take only seconds to complete and drastically reduce exposure to risk.” Since April 2024, new UK regulatory mandates have legally required manufacturers of specified consumer smart devices to meet baseline cybersecurity standards, including enforceable rules for default password protections and long-term security update support. The NCSC confirmed it is collaborating with global allied agencies and private sector stakeholders to conduct full forensics on the recent European supermarket incidents, and has not detected any operational impact on retail infrastructure within the UK to date. However, analysis from UK Cyber Defence researchers has uncovered over 800 publicly accessible interfaces tied to refrigeration units and building management systems operated by British retail chains. While public accessibility does not automatically equate to exploitable vulnerabilities, these unsegmented connections create unnecessary exposure that bad actors could leverage via weak default passwords or unpatched software flaws. The UK government has already convened high-level discussions with leading food retail executives to bolster industry-wide cyber resilience, building on lessons learned from prior disruptive attacks. Helen Dickinson, chief executive of the British Retail Consortium, noted that cyber threats now rank among the top operational risks for the retail sector, with member businesses actively partnering with the NCSC to share real-time threat intelligence and reinforce defensive protocols. This is not the first time cyber intrusions have threatened national food supply chains: in May 2025, ransomware attacks targeting major UK retailers M&S and the Co-op severely disrupted fresh food delivery logistics, leaving large swathes of store shelves empty and prompting widespread customer complaints across the country. Tom Hegel, a senior researcher at cybersecurity firm SentinelOne, stressed that retail operators must clarify lines of accountability for connected on-site equipment. “Retailers cannot afford ambiguity over who holds ultimate responsibility for the cybersecurity of this hardware, rather than only clarifying who is tasked with physical repairs,” Hegel explained. He warned that the convenience of internet connectivity carries tangible, real-world risk when security frameworks lag behind functionality: “Once an attacker gains control of these operational systems, even standard, legitimate functions like automated defrost cycles can be weaponized to cause deliberate disruption. A single altered setting can destroy thousands of pounds worth of perishable physical stock, rather than merely disrupting a digital computer network.” The security risks extend far beyond retail and domestic consumer appliances, as networked connected technology now forms the backbone of remote management for industrial manufacturing equipment, commercial fleets, and critical public infrastructure. Renowned cybersecurity expert Ken Munro cited the landmark 2015 research demonstration where security teams remotely compromised a Jeep vehicle through its internet-connected infotainment system, a high-profile incident that spurred the entire global automotive industry to implement sweeping security overhauls for connected vehicle systems. “Thankfully, the automotive sector recognized the urgency of the risk and moved quickly to resolve these gaps,” Munro noted. Mobile internet connections are now also widely deployed to remotely monitor and adjust operations at power generation facilities and public water distribution networks, but Munro cautioned that security standards are uneven across different sectors and geographic regions. While large UK utility providers generally maintain robust protections for these critical connected systems, his greatest concern centers on smaller, underfunded utility operators that continue to rely on outdated, unpatched legacy equipment with well-documented vulnerabilities. Olivier Daloy, a cybersecurity expert at global firm Zscaler, echoed these warnings, noting that without standardized, mandatory security safeguards, every internet-linked facility and piece of equipment – from automotive manufacturing plants to electricity grids and public transport networks – faces comparable risks of disruptive, financially damaging cyber intrusions.

A coordinated cyber incursion targeting connected commercial refrigeration infrastructure has crippled operations at dozens of grocery outlets spanning Belgium, Sweden, and Ireland, forcing retailers to discard massive volumes of frozen and chilled perishables after threat actors maliciously adjusted temperature controls to dangerously high levels. The widespread digital breach follows a nearly identical incident that compromised hundreds of French supermarket locations just one month prior, though law enforcement and cybersecurity teams have not yet publicly identified the perpetrators behind this latest cross-national campaign. In Belgium, two of the country’s largest grocery chains reported widespread disruption: 40 locations under leading domestic retailer Delhaize suffered overnight system failures that rendered their cooling units unresponsive, while 15 Belgian outlets of multinational giant Carrefour confirmed their technical teams are conducting full forensic analysis of the breach to trace the attack vector. Across the North Sea in Sweden, multiple independent ICA grocery stores operating outside the brand’s centralized corporate network fell victim to the hack, with one ICA location in the southern town of Sjöbo posting a public warning on social media that hackers had cranked freezer temperatures all the way to 50°C (122°F) in the middle of the night. The Sjöbo outlet temporarily shuttered to dispose of spoiled stock before resuming normal customer operations, while ICA’s corporate headquarters stated it is deploying dedicated support teams to assist all impacted franchise locations. Separately, 7 of Sweden’s 800 Coop supermarket locations were hit, with brand representatives confirming to the BBC that the incident has been fully contained and no further outlets are at immediate risk. In Ireland, 13 SuperValu stores also reported disruptions to their refrigeration systems linked to the same attack pattern. Local media estimates indicate thousands of euros worth of frozen and chilled food, ranging from frozen meat and dairy to pre-prepared meals, had to be completely discarded to avoid public health risks, as the extreme elevated temperatures rendered all perishable inventory unsafe for human consumption. Industry cybersecurity analysts note that the attack exploits the relatively weak security protections often deployed on internet-connected building management systems in retail settings, which are frequently not segmented from broader store networks or protected with the same rigorous safeguards used for point-of-sale and payment processing infrastructure.