The attacks, which targeted software provided by Danish engineering firm Danfoss, forced retailers to discard significant quantities of fresh and frozen food. In France, where a similar attack occurred three weeks prior, estimates suggest food losses reached tens of millions of euros. Across the continent, temperatures in affected refrigeration units reportedly rose as high as 50°C (122°F), a level that rapidly spoils perishable goods. The European Union’s food and agriculture commissioner, Christophe Hansen, stated that the bloc is taking the incidents seriously, warning of a deliberate attempt to disrupt the food supply chain. Commission spokesman Thomas Regnier noted that while no specific group has admitted responsibility, the incidents demonstrate how cyber-attacks can disrupt essential services and affect daily life.
The technological mechanism behind these disruptions relies on the increasing connectivity of industrial hardware. For decades, supermarket refrigeration units operated as isolated, mechanical systems. However, modern retail efficiency has driven the integration of Internet of Things (IoT) capabilities, allowing remote monitoring and control of temperature, defrosting cycles, and energy usage. Danfoss, the provider of the targeted software, stated that the affected units were older models whose security software could not be updated to mitigate a specific risk the firm had previously identified. In a statement, Danfoss emphasized that it had “long advised” businesses to keep supported systems up to date, adding that reliable refrigeration is critical to its customers’ operations.
The vulnerability lies in the exposure of these industrial control systems to the public internet. Researchers from UK Cyber Defence identified more than 800 refrigeration and building-control interfaces associated with British retailers that are accessible over the public internet. While accessibility does not guarantee a successful hack, it creates a pathway for attackers to exploit weak passwords or unpatched software vulnerabilities. In Germany, the attack in North Rhine-Westphalia was directed not at the supermarket itself, but at the company responsible for the remote maintenance of the cooling systems. Sandra Salten, regional director of the AWO supermarket operator, confirmed that the cooling sections and warehouse systems were affected, leading to the destruction of products at risk of spoilage. Similarly, in the Bavarian town of Reisbach, an Edeka branch reported its systems were switched to a “50-degree heating mode,” resulting in the disposal of large quantities of stock.
The incident has reignited debate over the security posture of connected devices. Ciaran Martin, former chief executive of the UK’s National Cyber Security Centre (NCSC), argued that manufacturers must do more to ensure the security of connected devices from the outset. “There’s a lot more that we need to demand of big tech to give us safer devices and products in the first place,” Martin said. He advised consumers and businesses to keep devices updated and enable multi-factor authentication, a measure he described as a quick but necessary step. Since April 2024, UK law has required manufacturers of certain consumer smart devices to meet minimum cybersecurity standards, including requirements around passwords and security updates. However, industrial equipment such as supermarket freezers may fall outside the scope of such consumer-focused regulations, leaving a regulatory gap that attackers can exploit.
Expert analysis suggests that while the attack was significant, it is part of a broader trend of “hybrid” warfare where cyber threats intersect with physical infrastructure. The EU has raised concerns that these incidents are not isolated but part of a pattern of government-backed or state-sponsored hybrid attacks. In Italy, Prime Minister Giorgia Meloni’s government called a meeting with intelligence chiefs, noting that while the immediate impact was “very limited” due to updated security systems in most of the food distribution chain, the affected businesses were “mostly still equipped with obsolete security systems, with interfaces directly exposed to the internet and inadequate authentication mechanisms.” This observation highlights a key technical limitation: the persistence of legacy systems in critical infrastructure. These older units often lack modern encryption or robust authentication protocols, making them prime targets for low-cost, high-impact cyber operations.
The commercial and social implications are substantial. For retailers, the cost extends beyond the value of spoiled food to include operational downtime, reputational damage, and the urgent need to disconnect systems from the internet to prevent further damage. In France, Intermarché and its Netto brand urgently disconnected approximately 100 shops from the internet after 180 stores were affected. Mousquetaires Group, the parent company, stated that some fresh and frozen food display units remained out of service for days. The incident has forced a reassessment of how critical infrastructure is managed, pushing for a shift from always-on connectivity to more segmented, local networks where possible.
Cybersecurity researchers have long warned that the expansion of IoT into industrial and domestic spaces increases the attack surface for malicious actors. Previous demonstrations, such as the 2015 compromise of a Samsung smart fridge, showed that even consumer-facing devices could be exploited to intercept traffic or gain network access. While modern vehicles and critical infrastructure like power grids have seen improvements in safety measures, the retail sector remains particularly vulnerable due to the fragmented nature of its supply chain and the prevalence of aging hardware. The latest attacks confirm that these theoretical risks have materialized into tangible economic and logistical disruptions.
As investigations continue in several European countries, including by federal prosecutors in Belgium, the focus remains on understanding the specific vectors used by the attackers. The NCSC is working with international partners and industry to analyze the supermarket incidents, though it reported no direct impact on UK operations. For Yorgos Bubas in Athens, the immediate solution was to cut the internet connection to his freezers, a move that restored control but at the cost of remote monitoring capabilities. This trade-off illustrates the current state of industrial cybersecurity: a balance between the operational convenience of connectivity and the physical security of the assets it controls. The next confirmed development will likely involve stricter regulatory frameworks for industrial IoT devices, mandating secure-by-design principles and mandatory patching cycles for critical infrastructure components.
