Freezer Attacks Expose Europe’s Neglected Infrastructure

More than 100 shops across several European countries found their internet-linked fridges and freezers running hot on Monday, destroying or damaging food as retailers confronted the cost of infrastructure left vulnerable to attack. The perpetrators and their motives remain unclear. The systems, however, were exposed: remote access, outdated software and weak security controls turned refrigeration into a point of failure for businesses and consumers.

The weak point behind the counter

Delhaize said dozens of shops in Belgium and Luxembourg were hit by an “IT incident.” Carrefour reported refrigeration problems at about 15 of its 700 Belgian locations, while the Colruyt group said five shops were affected. Swedish Coop reported problems at seven of its 800 stores, ranging from complete shutdowns to partial operation. IKEA said one site in Mons, Belgium, was affected.

At De Laet & Van Haver’s store in Hove, south of Antwerp, fridge temperatures climbed as high as 18 degrees Celsius, ruining meat worth about 15,000 euros ($16,764). Food wholesaler Musgrave said refrigeration systems in 13 of its SuperValu stores in Ireland were affected. Retailers in Sweden, Belgium, Ireland and elsewhere discarded large quantities of fresh and frozen food after systems switched into defrost mode.

British suppliers also became caught up in the wider wave. The National Cyber Security Centre (NCSC) confirmed that attackers had exploited vulnerable refrigeration technology in a small number of incidents. The British Association of Independent Meat Suppliers, which represents more than 300 businesses, said some members were affected, though none lost inventory.

A warning after years of underinvestment

Richard Horne, chief executive of the NCSC, said the agency had “worked through the night” to warn potentially affected British businesses. Asked who was responsible, he told BBC Radio 4’s Today programme: “It’s too early for us to say at the moment and give a definitive answer.” Horne said years of underinvestment had left technology underpinning essential services vulnerable.

The technical details make that neglect concrete. Awais Rashid, a professor of cybersecurity at the University of Bristol in the UK, said many supermarket refrigeration systems are remotely managed, often by third parties, and haven’t received necessary software updates. Some controllers have known vulnerabilities and have passed their end of life. “Easily guessable” passwords can also leave access exposed, he said.

Cybersecurity researchers identified more than 800 fridge interfaces associated with British retailers that people could access over the public internet. That doesn’t mean each system can be hacked, but experts warned that outdated software and poorly secured remote access put critical equipment at risk. Martin Riley, chief technology officer at cybersecurity firm Bridewell, said his firm had identified more than 6,000 refrigeration management panels from one manufacturer exposed online worldwide. “There is no backup to restore from. The stock is simply gone,” he said.

The state’s warning, the unresolved questions

European Commissioner for Agriculture and Food Christophe Hansen called the attacks a “deliberate attempt to disrupt” the bloc’s food supply and undermine consumer confidence. He said “food security is not currently at risk ... the food waste and impact on businesses are real.” Belgium’s prosecutor’s office has opened a criminal investigation. No one has claimed responsibility, and the available information doesn’t establish whether the incidents are connected.

On Tuesday, the NCSC warned that Britain needed to prepare for an AI-powered cyberattack on critical national infrastructure by 2028. Its report said Russia, China and other nation states were highly likely to routinely use AI-cyber for geopolitical goals. The UK’s “Be Ready” campaign asks citizens to stockpile enough tinned food, bottled water and cash to last three days in a cyberattack or national emergency. Horne said the risk came not because AI had invented new ways to attack, but because “vulnerabilities that have been tolerated for far too long” could now be found and exploited at scale.

Households have advice. Essential institutions still face a harder question: why were refrigeration controls exposed in the first place? The British Retail Consortium said retailers were working with the NCSC to strengthen defences. The NCSC still hasn’t identified who is responsible. The spoiled food is gone, and the weak points remain the subject of warnings rather than answers.