Supermarket refrigeration systems connected to the internet are becoming a growing cybersecurity concern after attacks on food stores across Europe exposed weaknesses in equipment designed to keep food fresh.
A series of cyberattacks has disrupted refrigeration systems at supermarkets in Belgium, France and Sweden, raising questions about why commercial fridges and freezers can be accessed remotely and how easily attackers can interfere with them.
In Belgium, dozens of supermarkets were affected after hackers targeted their refrigeration controls. Around 40 Delhaize supermarkets, at least 15 Carrefour stores and five Spar shops were among those affected, alongside the butchery group De Laet en Van Haver. The incident forced stores to discard food estimated to be worth approximately 100,000 euros. Belgian media reported that temperatures in some refrigeration units climbed as high as 70 degrees Celsius.
A spokesperson for Delhaize confirmed to Euronews that the company had identified an IT incident affecting refrigeration systems in several dozen stores.
Similar problems were reported at several outlets of Swedish supermarket chain ICA. The Belgian incident also followed an attack on 12 October, when hundreds of French supermarkets experienced interference with their refrigeration systems.
The incidents have drawn attention to an aspect of supermarket technology that most shoppers rarely consider: the equipment responsible for keeping refrigerated and frozen food at safe temperatures can be managed through internet-connected systems.
Large supermarkets generally use central refrigeration management units to control temperatures, schedule defrost cycles and monitor alarms across multiple refrigerators and freezers. Instead of managing each cabinet separately, staff and maintenance contractors can oversee the entire system through a central controller.
Internet connectivity allows authorised technicians to monitor these systems, identify faults and adjust settings without travelling to individual stores. This can save time and reduce maintenance costs, particularly for supermarket chains operating hundreds of locations.
Research published in October by cybersecurity company Forescout explains how widespread this arrangement has become. Refrigeration equipment manufacturers have developed systems that allow remote monitoring and maintenance as part of normal operations.
Danfoss, a major supplier of refrigeration controls in Europe, says internet connectivity can reduce unnecessary engineering visits by 15 to 30 per cent because technicians can investigate and resolve certain problems remotely.
Remote monitoring also helps supermarkets maintain temperature records required under food safety regulations. Rather than relying entirely on employees to inspect individual refrigeration cabinets several times a day, automated systems can record temperature changes and alert staff when equipment is not operating correctly.
However, the same remote access that makes refrigeration systems easier to manage can also create an entry point for cybercriminals.
Manufacturers provide installation instructions explaining how refrigeration controllers can be made accessible from outside a store. This can involve configuring a router to direct internet traffic to the refrigeration management equipment.
Forescout says the security problem is partly caused by the way responsibility for these systems is divided. A supermarket may own the refrigeration equipment, an external contractor may manage its software, while the store’s IT department controls the network connection.
When these responsibilities are not clearly coordinated, security gaps can remain unnoticed. Forescout’s researchers warn that no single party may have a complete picture of which refrigeration services are accessible from the internet.
The age of the equipment adds another concern. Some refrigeration controllers continue operating long after manufacturers stop providing security updates. One Danfoss controller identified in the research has been out of support since May 2021, meaning it no longer receives updates to address newly discovered security weaknesses.
The scale of the exposure is larger than the recent supermarket incidents might suggest. Using Shodan, a search engine that identifies internet-connected devices and services, Forescout found 12,976 refrigeration management services accessible online across 6,017 internet addresses in 99 countries and territories.
Two product groups accounted for most of the exposed systems. Copeland and Dixell’s XWEB systems represented 7,075 services, while Danfoss StoreView accounted for another 4,697.
The research also identified outdated software across a significant proportion of the exposed equipment. Around 80 per cent of the Danfoss services were running firmware older than the version that addresses known security vulnerabilities.
These figures do not mean that all the identified systems have been compromised. They show that the equipment can be reached through the internet and may be vulnerable if security protections are inadequate.
The concern also extends beyond grocery stores. Similar refrigeration management technology is used in food processing facilities, wineries, fruit storage facilities, farms and hospitals. A successful attack could therefore affect equipment responsible for storing food, agricultural products and temperature-sensitive medical supplies.
Another difficulty is that attackers may not need to install complicated malicious software to interfere with these systems. If they gain access to a refrigeration controller, they may be able to use its ordinary operating functions to change temperatures, activate defrost cycles or disable alarms.
Because these commands are part of the equipment’s normal operation, unusual activity may not immediately appear to be a cyberattack. A sudden temperature change or disabled alarm could initially be mistaken for a technical fault.
Forescout recommends removing refrigeration management systems from direct exposure to the public internet and providing contractors with access through secure remote access tools instead.
The company also advises supermarkets and other operators to replace equipment that no longer receives security updates, stop using shared passwords among contractors and introduce individual accounts protected by multi-factor authentication. Keeping records of system access and changes is also important because it allows operators to identify who accessed the equipment and what adjustments were made.
The recent incidents show that cybersecurity risks are no longer limited to computers, payment systems and customer databases. Equipment that operates behind the scenes, including the refrigeration systems responsible for keeping supermarket food safe, can also become a target when connected to the internet without adequate protection.
