The incident was part of a broader wave of cyberattacks that hit supermarket fridges and freezers across Europe on Monday, affecting retailers in Sweden, Estonia, Ireland, the Netherlands, and Luxembourg. In Belgium, approximately 40 Delhaize supermarkets were impacted, while a smaller number of shops in other nations reported similar disruptions. The attack method was consistent with previous incidents: hackers remotely adjusted the temperature of refrigeration units, in some cases raising them as high as 55°C. This caused evaporators to switch to defrost mode, rapidly warming the units and spoiling fresh and frozen goods. Sabcobel, a Belgian manufacturer of some of the affected refrigerators, confirmed that the units’ evaporators were the target of this manipulation.
While the immediate impact was financial, with estimates of millions of euros in lost produce, the technological implications are far more significant. The National Cyber Security Centre (NCSC) in the UK stated that it was aware of “a couple of instances where vulnerable technology had been exploited” in the UK, though the British Association of Independent Meat Suppliers (AIMS) noted that none of its affected members had lost meat. Dr. Richard Horne, the NCSC’s chief executive, emphasized that the organization had “worked through the night” to alert potentially affected companies. He described the situation as an urgent need for businesses to secure the technology underpinning daily applications, noting that many firms had extended systems beyond their end-of life without upgrading or isolating them from the internet.
Cybersecurity experts argue that these attacks exploit vulnerabilities that were previously identified by researchers but left unpatched. Josh Corman, a former official with the U.S. Cybersecurity and Infrastructure Security Agency, noted, “With great connectivity comes great responsibility. As we connect industrial refrigeration to the Internet, we expose it to accidents and adversaries.” He warned that while current attacks have targeted food, future incidents could target “temperature sensitive drugs and laboratory materials,” posing risks that extend well beyond the grocery sector.
The pattern of these attacks suggests a calculated escalation. Omri Segev Moyal, head of the Israeli incident response firm Profero, described a sequence of events beginning in May in Israel, where a food production plant suffered a multi-pronged attack. In that instance, printers spat out threatening messages, malicious code wiped internal data, and industrial freezers were damaged, halting operations for over a week. Moyal, based on forensic data and claims from the perpetrators, attributes the refrigeration attacks to Iranian military hackers operating under the name Cyber Isnaad Front, a group also linked to influence campaigns targeting U.S. elections in 2024. “We’re observing targeted attacks gradually built and practiced against Israel, tested in Europe and the U.S., and unleashed [now],” Moyal said.
This narrative of escalation is supported by the timing of recent incidents. As early as March, hackers allegedly targeted a small chain of kosher grocery stores in Israel, a claim supported by social media footage of spoiled meat. Months later, the attacks expanded to include U.S. military bases in August, French supermarkets in October, and the broader European retail sector in November. The French attacks in early October had already targeted hundreds of stores, exploiting the same vulnerabilities in remote control systems for cold refrigeration units.
The use of artificial intelligence in these operations has been flagged by security leaders. Dr. Horne noted that while vulnerabilities in aging infrastructure are “low-hanging fruit,” AI in the hands of adversaries allows these weaknesses to be found and exploited more quickly and easily. “That technology base we rely on as a society has not been invested on to the extent it needs to be,” Horne said, urging organizations to make the choice to invest in renewal. The NCSC clarified that it is still “too early to say” definitively who is behind the latest hacks, but the convergence of evidence points to state-sponsored actors testing capabilities against critical infrastructure.
For businesses, the lesson is clear: connectivity without security is a liability. The attacks have forced retailers to confront the reality that their physical assets are now digital targets. As AIMS communications head Tony Goodger urged, the industry must be vigilant, recognizing that their businesses may be seen as targets by those with advanced digital capabilities. The next confirmed development in this unfolding crisis will likely involve further forensic analysis to confirm the attribution of the attacks and a renewed push by governments to mandate the patching of legacy industrial control systems before the next wave of exploitation.
