A cyberattack has hit refrigeration systems at dozens of Belgian supermarkets, forcing stores to throw away around €100,000 worth of food.
Around 40 Delhaize supermarkets were affected, along with at least 15 Carrefour stores, five Spar shops and the butchery group De Laet en Van Haver. Belgian media reported that fridge temperatures rose as high as 70°C.
A Delhaize spokesperson told Euronews the company had “identified an IT incident affecting the refrigeration systems in several dozen stores”.
Problems were also reported at several stores of the Swedish chain ICA. The attack follows a similar one on 12 October, when hundreds of French supermarkets had their refrigeration systems tampered with.
So why can someone take control of a supermarket firdge or freezer without being in the store?
Why are fridges online?
Large supermarket refrigeration systems are run by central management units that control temperatures, defrost cycles and alarms for every chiller and freezer in the store.
Connecting these units to the internet has long been a supported option, according to research published in October by the cybersecurity firm Forescout. It lets refrigeration contractors diagnose faults and adjust settings remotely, rather than sending a technician to every store.
Danfoss, one of the main suppliers in Europe, says connecting refrigeration controls to the internet typically cuts unnecessary engineer callouts by 15 to 30% because faults can be fixed remotely.
The company also says remote monitoring lets supermarkets keep the temperature records required under food safety rules automatically, rather than having staff check each cabinet by hand up to four times a day.
Manufacturers’ own installation guides describe how to make the systems reachable from outside, for example by setting up the store’s router to forward internet traffic to the refrigeration controller.
The problem, Forescout says, is that responsibility is often split. A contractor may manage the software, the store may own the equipment and its IT department may run the internet connection. Unless roles are clearly assigned, “no single party may have complete visibility into the exposed service”, the researchers wrote.
Some of the equipment is also old. One of the Danfoss controllers involved has been out of support since May 2021, so it can no longer receive security updates exposing it to a breach from an external device.
What is the scale of the risk?
Using Shodan, a search engine that indexes devices connected to the internet, Forescout found 12,976 exposed refrigeration management services on 6,017 internet addresses in 99 countries and territories.
Most belonged to two product families: Copeland and Dixell’s XWEB systems (7,075) and Danfoss’s StoreView (4,697).
Of the Danfoss services, 80% were running firmware older than the version that fixes known security flaws. The figures count systems that are exposed, not ones that have been hacked.
The risk goes beyond supermarkets. The same systems are used in food processing, wineries, fruit stores, farms and hospital cooling equipment.
Attackers do not need sophisticated malware. Once inside, they can use the system’s normal functions to change temperatures, trigger defrost cycles or switch off alarms. Forescout notes that such changes can look like routine activity.
What can be done?
Forescout’s main recommendation is to take refrigeration management systems off the open internet and give contractors access only through secure remote access tools.
It also urges operators to replace equipment that no longer receives security updates, scrap shared contractor passwords in favour of individual logins with multi-factor authentication, and keep records of who changes secure information.