Supermarket fridge cyber attack hits UK firms: what shoppers face

On Monday, November 2, grocers in several European countries found their chilled and frozen cases warming up for no obvious reason. Several later confirmed they had been hacked. Reports differ slightly on the count: some list seven countries, while one security outlet counts nine, adding Italy and Portugal to the list.

The biggest single cluster was in Belgium and Luxembourg, where around 40 Delhaize supermarkets were affected. Here’s how the wave played out elsewhere:

• Belgium: Carrefour says just 15 of its more than 700 Belgian stores were hit. Colruyt Group, which runs franchised Spar shops there, says five stores had their fridge systems attacked. Ikea’s store in Mons also had its freezers warm up, though it stayed open.
• Ireland: Musgrave, the wholesaler behind SuperValu, says 13 of its stores were affected and it pulled some chilled and frozen products from sale.
• Sweden: A handful of ICA stores that use an outside supplier, with connections running outside ICA’s own network, were hit. One ICA Kvantum branch posted that its fridges had been set to 50C. Coop says six of its stores saw similar problems.
• Netherlands and Estonia: Ahold Delhaize reported an IT incident affecting refrigeration in some Dutch stores, and an Estonian maker of the affected equipment says a client’s control computer was accessed and the heat turned up.

Many retailers had to throw food away. Some put the losses in the hundreds of thousands of euros.

The method is almost boringly simple. Sabcobel, a Belgian refrigeration company that runs Delhaize’s systems, says the attackers switched the units’ evaporators (the parts that actually pull heat out of the cabinet) into defrost mode. Every commercial freezer has that mode so ice can be cleared. Leave it on, and the case warms up.

The same trick is believed to be behind last month’s attack on hundreds of French supermarkets. That earlier attack used old equipment that had been left reachable from the internet with its factory-set passwords still in place.

A security firm called Lupovis set up fake Danfoss fridge controllers online as bait, known as honeypots, and logged 256 break-in attempts from 91 different sources between October 20 and October 30. Most of the login attempts used the maker’s own published default username and password. In other words, attackers were trying the front door key that comes printed in the manual.

The NCSC’s director of operations, Paul Chichester, says the attacks weren’t powered by AI and relied on weaknesses that have been around for a long time.

Nobody knows yet, and no group has claimed responsibility. The NCSC says it can’t comment on who did it, and Sweden’s cyber agency won’t speculate either.

There are hints, though. Lupovis chief executive Xavier Bellekens says some of the infrastructure used to probe its fake controllers overlaps with infrastructure his firm previously linked to Russian-linked malicious operations, including so-called bulletproof hosting (internet providers that tend to ignore abuse complaints). He stresses his team can’t name a group.

The EU’s agriculture and food commissioner, Christophe Hansen, has called the attacks a deliberate attempt to disrupt Europe’s food supply and shake shoppers’ confidence. That language suggests officials are taking a possible state link seriously, but it isn’t proof.

The UK impact so far is small, and it landed on suppliers rather than shop floors. The British Association of Independent Meat Suppliers, which has more than 300 members, says some of them became collateral damage. Two saw their fridges start to defrost, and one saw its cold units climb as high as 100C (212F). Luckily, those units were empty, so no meat was lost. A London fruit and vegetable wholesaler was also reportedly affected without losing stock.

NCSC chief executive Richard Horne says the agency worked overnight to warn UK organisations that might be exposed. The British Retail Consortium, whose members include Tesco, Sainsbury’s, Asda, Lidl and M&S, says big grocers are working with the NCSC to lock their fridges and freezers down.

If you shop in the UK, US or Canada, there’s no sign of any risk to food on your local shelves right now. The stores hit in Europe spotted rising temperatures and pulled stock, and that’s the system working. The real cost so far is waste and empty shelves, not unsafe food being sold.

Your own fridge is a different question. The supermarket gear involved is commercial kit, not a home appliance. But the NCSC’s chief technology officer, Ollie Whitehouse, says everyday connected devices in the home can be vulnerable in certain situations, and that makers need to build safer products. He also says buyers may need to accept paying a bit more for that.

The weak point in the supermarket attacks was old, internet-facing equipment still using its factory password, and the NCSC’s own home guidance targets exactly those gaps. It names fridges, kettles and thermostats alongside speakers and cameras as smart devices that need a little setup. Its advice for a connected fridge or any other smart gadget at home:

• Replace any default password. If the device shipped with one, swap it for your own when you set it up. A guessable password lets a criminal log in and use the device to reach the rest of your network.
• Turn on 2-step verification if the app or device offers it, so a stolen password isn’t enough on its own.
• Switch off remote access if you never need to control the appliance while you’re away from your home Wi-Fi.
• Keep updates flowing. Turn on automatic updates where they exist, and install manual ones when you’re prompted.
• Check the support end date. The NCSC suggests treating it like a use-by date, and advises against buying devices whose support has ended or is about to.

UK buyers have some extra protection. Since April 2024, UK law has required new smart devices to meet basic security rules, including stating how long they’ll get support and not shipping with shared default passwords. If you think someone has taken control of a device at home, the NCSC says to reset it following the maker’s instructions.

Expect more of this, says the UK’s cyber chief. Horne describes the fridge attacks as the foothills of a bigger threat, as AI tools make it easier for attackers to find unpatched systems that owners have forgotten about. Many firms have kept equipment running past the end of its supported life, he says, without upgrading it or keeping it walled off from the internet.

Sweden’s cyber agency says it has found a lot of exposed industrial equipment in the country and has been urging owners to patch it. Hansen says the attacks will come up at the next meeting of the European Commission’s Security College, which will look at how ready retailers are to respond.