Second wave of supermarket refrigeration cyberattacks hits Europe — lessons for UK operators

A second wave of cyberattacks targeting supermarket refrigeration systems has affected over 100 stores across at least seven European countries, including Ireland, Belgium, Estonia, Finland, Sweden and Luxembourg, according to SecurityWeek. Attackers remotely altered the settings on internet-exposed refrigeration controllers overnight, causing temperatures in fridges and freezers to rise to as high as 50°C. Stores were forced to discard chilled and frozen food and in some cases close affected sections. Danish refrigeration controls manufacturer Danfoss has been identified as a common factor in the affected systems. The attacks closely mirror an incident last month that caused millions of euros of damage in France, suggesting a deliberate and sustained campaign rather than isolated opportunistic activity.

Why this matters for UK organisations

The refrigeration controllers targeted in these attacks are a form of operational technology — devices that manage physical processes and that, when compromised, cause tangible real-world harm including food waste, supply chain disruption and financial loss. While the immediate impact falls on the retail and food supply sector, the broader lesson applies to any UK organisation that relies on internet-connected operational technology or building management systems, including logistics operators, food manufacturers, hospitality businesses, healthcare facilities and commercial property managers. The fact that this is the second coordinated wave of attacks in a month is a meaningful signal. It suggests that attackers have identified internet-exposed industrial control systems as a viable and relatively low-resistance target, and that organisations which have not yet addressed their exposure remain at risk. Ireland's inclusion in the affected countries makes this directly relevant to UK and Irish operators.

What to review

Organisations operating refrigeration systems, HVAC controls, building management systems or similar operational technology should audit what is currently internet-exposed and whether that exposure is necessary. Where remote access to these systems is required, it should be protected by strong authentication, restricted to known IP ranges where possible, and monitored for unusual activity. Default credentials on industrial control devices should be changed as a baseline measure. Facilities and IT teams should work together to ensure that operational technology is included in the organisation's broader asset inventory and security monitoring scope, rather than being treated as outside the remit of the security function.

Source: SecurityWeek