Cyberattacks raise freezer temperatures at supermarkets across Europe

What happened

On Monday, refrigeration at more than 100 shops in several European countries overheated after remote access to internet-connected controllers. In October, hundreds of French supermarkets lost tonnes of food, and some units caught fire or melted after temperatures were pushed as high as 50C.

Dutch operator Delhaize reported dozens of Belgian and Luxembourg shops affected by an IT incident. Carrefour cited refrigeration problems at about 15 of its 700 Belgian locations, Colruyt five Spar shops, Swedish Coop seven stores and Musgrave 13 SuperValu stores in Ireland. A Belgian butchery said one store's fridges reached 18C, ruining meat worth about 15,000 euros.

Who is behind it

Belgium's prosecutor's office announced on Monday that it had opened a criminal investigation, but no one has taken responsibility. European Commissioner for Agriculture and Food Christophe Hansen said the attacks were a deliberate attempt to disrupt the bloc's food supply and undermine consumer confidence, adding that food security was not currently at risk.

Rafe Pilling of Sophos said the two most plausible explanations were state-based signalling of capability or a lone-wolf hacker. Al Jazeera noted theories involving state actors but did not attribute the attacks. In the US, the Pentagon is investigating suspected hacks at military bases in Arizona and Rhode Island in August.

Why fridges are exposed

Awais Rashid, a cybersecurity professor at the University of Bristol, said many supermarket refrigeration systems are remotely managed, often by third parties, and lack necessary software updates. He cited known vulnerabilities in controllers, many past end of life, and easily guessable passwords. Pilling said no malware was needed, making the culprit hard to trace. UK retailer representatives said they were working with the National Cyber Security Centre, which said the UK has not been affected.