Supermarket Freezer Cyberattacks Expose Gaps in IoT and Vendor Security

European supermarkets are learning that a refrigeration controller can become an operational and cybersecurity risk when it sits beyond the reach of the teams responsible for securing the business. A second wave of attacks, reported on Monday, November 2, disrupted freezer and fridge temperatures at retailers in Belgium, Ireland, Sweden, Finland and Estonia, only weeks after a similar incident in France spoiled food and caused fires.

The pattern points to a problem larger than exposed devices. Retailers may own the refrigeration equipment while contractors install, monitor and maintain it, leaving responsibility for securing its network access unclear. When a controller can change temperatures across a store, that ambiguity turns into a risk to inventory and day-to-day operations.

Repeated attacks put refrigeration controls in focus

The Monday incidents reportedly affected Carrefour, Spar and Ahold Delhaize. No group had claimed responsibility at the time of the report. Like the October attack in France, the new incidents involved sudden changes to refrigerator and freezer temperatures.

Ahold Delhaize said an incident affected refrigeration systems in dozens of Delhaize stores. A company spokesman told CSO that the retailer took steps to limit the impact and keep its stores operating. The situation later returned to normal, but the company had to discard food.

That physical consequence is what makes these attacks stand out. The reported method involved manipulating a normal refrigeration function, defrost, rather than deploying malware. David Neuman, an executive advisor at Acceligence, said exploiting that function can cause financial and physical damage without malware. In his view, a warning alone could not fix the underlying issue when nobody inside a store clearly owns the controller or its network connection.

France’s Computer Emergency Response Team, CERT-FR, had issued guidance after the mid-October attack. It advised organizations to disconnect refrigeration controls with public IP addresses from the internet, then reconnect them through a secure VPN only after checking their configuration and restoring factory defaults if needed. As a temporary measure, organizations could restrict access to the IP addresses used by refrigeration suppliers or service providers. CERT-FR cautioned that this should not become the long-term arrangement.

Ownership gaps make warnings hard to act on

The technical recommendation may be straightforward; carrying it out across a large retail estate is not. Refrigeration systems often involve several vendors and maintenance contracts, while store operators may depend on a continuous data feed that lets contractors monitor equipment remotely.

Gartner Distinguished VP Analyst Katell Thielemann said retailers typically own the hardware but outsource its upkeep and management. That arrangement can leave confusion over which party controls each part of the system. IDC Senior Research Manager Bobby Kuzma described a related visibility gap: cybersecurity staff tracking vulnerabilities may not know that operational technology is connected to the network, particularly when a supplier uses a dedicated internet circuit for support.

Neuman said taking controllers offline can require locating them and changing how contractors access them, store by store. Brian Levine, a partner at Control Risks, said connected operational equipment has long been treated as a facilities responsibility. Now that these systems have produced physical consequences, he expects boards to ask why vendor contracts, incident response plans and tabletop exercises did not account for that possibility.

Contract terms can further slow the response. Dickson Research principal analyst Frank Dickson pointed to CERT-FR’s advice to check insurance terms before disconnecting a controller. If a contractor installed, monitors and guarantees the equipment, a store may lack the authority or practical ability to cut its connection without affecting service. Dickson argued that retailers should close the internet exposure first and resolve contract terms afterward.

Asset inventories have to include store equipment

Kuzma framed the core security challenge as knowing what is connected. Without a complete inventory, an organization cannot reliably assess exposure or scan an unknown connection. In some cases, he said, that means inspecting communications closets at individual locations and asking what equipment is present. A device exposed through a public internet connection creates risk even if it is an appliance rather than a conventional computer.

Independent technology analyst Carmi Levy said IT teams often have a narrow definition of connected devices. Refrigerators, floor cleaners and other machines may be deployed by business or facilities teams without IT’s involvement, then remain unnoticed as their firmware ages. That blind spot makes it easy for connected equipment to miss the same security reviews applied to servers and phones.

Age adds another complication. Digital 520 principal consultant Noah Kenney said some controllers may have passed their end-of-life, leaving organizations without security patches or upgrades. The equipment can continue doing its job while becoming harder to secure. Retailers then have to weigh network isolation and other safeguards against the eventual need to replace it.

Kenney also questioned whether the systems impose enough limits on remote commands. If access to a controller can translate into operations far outside intended temperature settings, independent safeguards may be insufficient. A secure connection matters, but so does preventing a valid command from causing damaging physical effects.

Building systems can put IT equipment at risk

Refrigeration is one example of a wider operational technology problem. Dickson warned that attackers who reach building management systems could disrupt the cooling that servers depend on, without accessing the servers themselves. Equipment designed to shut down when it overheats may protect itself, but the resulting outage can still affect business services.

The practical task for retailers is to connect asset discovery, vendor access and incident response. Teams need to know which controllers are online, who can reach them, what commands they can execute and who has authority to isolate them. The attacks suggest that store infrastructure now belongs in cybersecurity planning alongside systems traditionally managed by IT. A warning can identify the exposure; only clear ownership and enforceable technical safeguards can close it.