Searching for advanced attacks on corporate databases or cloud environments is slowly taking a back seat to much more mundane yet terrifying incidents. The waves of cyberattacks sweeping across European supermarkets have proven one thing: critical infrastructure and physical food supply chains are full of holes. Hackers didn't need to steal bank account passwords – it was enough to remotely "cook" store refrigerators, driving temperatures up to 50°C (122°F).
In this article, we will examine how the mass takeover of refrigeration controllers in Europe happened, why IoT devices have become a new attack vector, and how CERT teams and national cybersecurity agencies respond to these threats.
Expert perspective: EU food safety officials explicitly categorized these incidents as "food weaponization." The attack was not aimed at stealing money, but at directly disrupting societal functioning and causing chaos.
1. How did the attack on store freezers unfold?
The first massive incidents were reported in France, where refrigeration systems in hundreds of supermarkets (including Carrefour, Intermarché, E. Leclerc) were compromised. The issue quickly spread to other European countries – Sweden, Belgium, Estonia, Portugal, and Ireland.
The attackers' mechanism proved terrifyingly simple:
- Mass network scanning: Cybercriminals used internet scanners to look for refrigeration control devices (such as popular Danfoss AK-SM controllers) exposed directly to the public internet.
- Exploiting security flaws: Many systems used outdated software versions, default credentials, or very weak passwords without active security patches.
- Defrost mode override: Attackers remotely altered temperature setpoints or switched units into emergency/deep defrost mode, rapidly raising temperatures in freezers and spoiling tons of food.
2. Why are IoT devices so vulnerable?
The supermarket fridge crisis is a classic example of ignoring security principles in the IoT (Internet of Things) and industrial OT sectors. In the pursuit of convenience and automation, modern stores connect almost everything to the internet – from air conditioning and lighting to advanced cold-storage controllers.
The main sins of negligence in this case include:
- Exposing management panels directly to WAN: Industrial controllers landed on public networks without being hidden behind a secure VPN tunnel or corporate firewall.
- Lack of strong password policies: Leaving manufacturer default login credentials made it easy to hijack control using simple brute-force scripts.
- Lack of regular updates: These devices operate for years, and the software installed on them is rarely audited or patched.
3. Response and mitigation
This wave of cyberattacks served as a harsh wake-up call for the retail and industrial sectors. National cybersecurity teams across Europe quickly issued warnings, identifying numerous refrigeration devices potentially exposed to this type of interference.
Through swift cooperation with system administrators and facility owners, many vulnerable devices were isolated from the public internet or secured before large-scale material losses occurred. This demonstrates how crucial staff vigilance and rapid anomaly detection in temperature monitoring systems truly are.
Summary
The hacked supermarket fridges serve as a clear warning sign for the entire market. In an era of universal digitization, every device connected to the network – whether an office computer or an industrial freezer – becomes a potential attack vector. Security is no longer solely the domain of IT departments, becoming a critical pillar for the physical survival of modern businesses.