Fridge Hacks Spread to Supermarkets in Seven European Countries; No One Has Claimed Responsibility

Since hackers hit 150 to 200 Intermarché stores and nearly 100 Coopérative U outlets in France on Oct. 12, according to the retailers, the attacks on supermarket refrigeration have spread across Europe. Stores in Sweden, Estonia, Ireland, Luxembourg, the Netherlands and Belgium were hit in early November, including big-box stores like IKEA, per NPR's reporting.

In seven European countries, thermostats were remotely cranked up, in some cases to 50°C (122°F), according to The Guardian. The European Union condemned what it called "a deliberate attempt to disrupt our food supply chain and undermine consumers' confidence in it."

Who is behind it

Nobody has said. No hacktivist group has claimed responsibility. No ransomware gang has demanded payment, which would be pointless anyway, since the food is already spoiled by the time anyone notices.

Rafe Pilling, senior director of threat intelligence at Sophos, told The Guardian the two most plausible scenarios are "some kind of state-based signalling and demonstration of capability or some kind of lone-wolf hacker that is conducting these attacks for their own personal reasons."

The method makes attribution harder. No malware was needed, Pilling said, so there is no weapon left at the scene. He compared it to "wearing rubber gloves and messing with the switches." The initial intrusion method in the French attacks has not been confirmed.

One attack has been pinned on a named actor. In May, a large Israeli food plant saw printers spit out threats, data-wiping code appear on office computers and industrial freezers destroy their own compressors. Operations stopped for over a week. Omri Segev Moyal, head of the Israeli incident response firm Profero, which handled the case, said forensic data and direct claims from the culprits convince him that Iranian military hackers calling themselves Cyber Isnaad Front were responsible. The attack came in the waning days of an Iran-Israel ceasefire.

Moyal says the later attacks fit a pattern: "targeted attacks gradually built and practiced against Israel, tested in Europe and the U.S., and unleashed [now]." He has not tied the European incidents to Iran by name, and the attackers in those cases remain unidentified. Attacks on U.S. military bases in August have also been reported.

The Guardian reports that hackers linked to Russia and China are also considered likely suspects, citing Western intelligence chiefs who say Moscow is running a sabotage campaign in Europe that is expected to intensify. That is a suspicion, not a finding.

Why it was easy

The software managing commercial refrigeration is often connected to the internet and rarely updated. Nick Jackson, director of cyber-operations at Bitdefender, said patching can mean taking machinery offline, which is a real problem for a grocer. He added that a simpler explanation may be that operators "don't think about that and it's not top of their agenda."

The exposure is large. Researchers at UK Cyber Defence have identified more than 800 refrigeration and building-control interfaces tied to British retailers that can be reached over the public internet, the BBC reported. Exposure alone does not mean they can be hacked, but weak passwords or unpatched software would make them targets.

The same weakness has shown up outside the food business. In July, CISA observed malicious activity against more than 100 internet-exposed systems in the U.S. water and wastewater sector, often programmable logic controllers connected through cellular modems. Investigators found common network configurations supplied by third-party providers across multiple victims, according to an OT security analysis of the incidents. One shared configuration gives an attacker a repeatable path into many customers.

Reported victim counts vary. The retailers put the French total at roughly 250 to 300 stores. A security-industry write-up cites approximately 700 French supermarkets, with Danfoss controllers among the affected equipment. The difference has not been explained.

Who should fix it

The sources split on where responsibility sits. Ciaran Martin, former chief executive of the UK's National Cyber Security Centre, argues manufacturers must do more: "There's a lot more that we need to demand of big tech to give us safer devices and products in the first place." Since April 2024, UK law has required makers of certain consumer smart devices to meet minimum standards on passwords and security updates. That law covers consumer gear, not industrial refrigeration controllers.

The operators' side is simpler and cheaper. A grocer who puts a controller on the open internet with a default or weak password has made the attacker's job easy. No new federal program fixes that. Taking the controllers off the public internet does.

The BBC found no evidence that household appliances are being targeted. Josh Corman, a former CISA official focused on public safety, warned that the next targets could be "temperature sensitive drugs and laboratory materials."

The UK's NCSC says it is working with international partners and industry on the supermarket incidents and is unaware of any impact in Britain. Helen Dickinson, chief executive of the British Retail Consortium, says retailers are working with the NCSC to share intelligence. Whether anyone claims the attacks, or whether investigators can name who is behind them, is still unanswered.