Cyberattacks affecting supermarket refrigeration systems in several European countries on Monday highlighted the risks associated with connecting industrial equipment to the internet.
After a previous attack in France in October, several chains in Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands and Sweden experienced stark rises in fridge and freezer temperatures on Monday, forcing them to throw away spoilt produce.
Real world effects
Industrial equipment such as refrigeration systems, once operated largely offline, is now commonly connected to the internet so it can be monitored and managed remotely, cybersecurity specialists including Antoine Hautin, secretary-general of the Almond cybersecurity consultancy, told AFP.
That connectivity can also provide an avenue for attackers to interfere with physical systems through digital networks.
In France, the attackers targeted the fridge regulation system made by the Danish firm Danfoss, which is used by many shops.
“Most of the time, that’s done through a web interface. You connect to it with a password and you then have the possibility to choose what the temperature in the fridge is,” said Kevin Tellier, cybersecurity engineer at Synacktiv.
While these systems “are normally on a closed network” and “are not supposed to be accessible from the Internet”, a number of them ended up being exposed “to anyone with some basic knowledge”, he added.
Without proper protections, “any factory or equipment” connected to the internet — ranging from carmakers to electricity or transport infrastructure — could face similar risks, said Olivier Daloy, a cybersecurity expert at Zscaler.
How was it done?
According to another cyber expert who requested anonymity, industrial infrastructure is particularly vulnerable because it links IT systems with oft-outdated physical equipment.
By infiltrating those IT systems, hackers could hijack that infrastructure and cause disruption in the real world.
Daloy highlighted two particular risks: the exploitation of a technical vulnerability and the use of compromised credentials allowing hackers to log in to the equipment.
He pointed to the Stuxnet virus in 2010, which caused a series of failures in Iran’s centrifuge fleet used for uranium enrichment, as a past example.
In France, the October cyberattack was made possible by “basic security shortcomings”, according to Vincent Strubel, head of France’s National Cybersecurity Agency.
In particular, he blamed the fridges’ “direct exposure to the internet… without any particular security and with weak passwords”.
Who could be behind it?
Figuring out who could be behind the attack in France is “extremely complicated”, Daloy said.
Tellier agreed. “It could be anybody. The attack was not extremely sophisticated, so we cannot determine whether the hackers have significant resources or not.”
One security source told AFP that the investigation into the breach will “extend far after the event itself”.
A 2025 French national security document identified such attacks as “one of the threats that must be treated as a priority”.
“These incidents highlight how vulnerable food supply chains are to cyberattacks,” with far-reaching consequences, the document said.
