Twelve Weeks’ Notice

Europe’s supermarket fridges were hacked in nine countries. The only surprise is that anyone was surprised.

Four in the Morning, Aisle Seven

At four o’clock on Monday morning, in a Coop supermarket in Sicily, the frozen food section quietly stopped being a frozen food section. Nobody broke a window, jimmied a fire door or crept past a dozing guard with a torch between their teeth. Someone, somewhere, logged into the remote-control system that runs the freezers and told them to stop doing the one job they have, and the contents of the cabinets began their slow journey from stock to skip.

By the time staff arrived, the same thing had happened, or was being investigated, in shops across nine European countries: Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden. In Estonia, according to the public broadcaster ERR, refrigeration units were reportedly cranked up to 50°C, which makes them less a fridge and more a sauna with price labels. Carrefour, Delhaize, Colruyt, Intermarché, SuperValu, Coop, even IKEA’s food hall in Mons… names you’d recognise, all reaching for the same careful word: incident.

The European Commissioner for Agriculture and Food, Christophe Hansen, called it a deliberate attempt to disrupt the food supply and erode consumer confidence. It may well be. But here’s the bit the breathless headlines skate over, and the bit I can’t stop chewing on. None of this was a surprise. Not to the manufacturer, not to the security researchers, not to the national cyber agencies and not, had they been paying attention, to the retailers. The warnings had been arriving for twelve weeks. They just hadn’t been signed for.

The Paper Trail

On 9 August, researchers at Claroty’s Team82 published work detailing vulnerabilities in Danfoss refrigeration controllers. Danfoss is a Danish engineering firm whose kit sits behind the cold aisles of a very large number of European supermarkets, and that isn’t a criticism in itself, because somebody has to make the stuff. But a published vulnerability is the security equivalent of a notice pinned to the staffroom board saying the lock on the back gate is broken. Everyone can read it, including the people you’d rather didn’t.

Later that month, around a dozen US military commissaries saw their fridges slip into unscheduled defrost cycles, with food lost as a result. Nobody has formally tied that to what followed, and I’m not going to pretend otherwise, but Reuters noted the resemblance and so, frankly, would anyone with a pulse.

Then France. Overnight on 11 to 12 October, attackers hijacked refrigeration controllers running older Danfoss software and triggered the built-in defrost system, pushing temperatures as high as 50°C. Intermarché, Netto, Coopérative U, Carrefour, Monoprix, Auchan and E.Leclerc were all caught up in it. Estimates of the scale wander about depending on who you ask, from around 180 stores by one owner’s count to several hundred by others, but the pictures were the same everywhere: empty cabinets, skips of spoiled stock and, in some stores, fires. The Paris prosecutor opened an investigation, and the head of Coopérative U called the attack unprecedented.

Danfoss confirmed that the targeted models were either obsolete (the AK-SM800 and AK-SC355) or hadn’t been updated (the AK-SM800A). France’s national incident response team, CERT-FR, issued an alert the same day, and the cybersecurity agency ANSSI told operators to disconnect affected units from the internet, or at least restrict access, and to update their software. A researcher at Predicta Lab went looking and found 2,752 Danfoss systems exposed online, 1,590 of them in France. Do the arithmetic and that leaves more than a thousand elsewhere, sitting there with the porch light on.

Three weeks later, on 2 November, nine more countries. In Belgium, the refrigeration firm Sabcobel said it had begun securing installations after the French attack, but some systems hadn’t yet been upgraded and were hit. In Estonia, the units were older Danfoss models like the ones targeted in France. In Sweden, Ica said all its affected stores used an external Danfoss control system. And in Finland, the National Cyber Security Centre said the spread beyond France was expected. Expected. Hold on to that word.

Signed For, Not Read

I spent seven-odd years in the RAF Police and a good chunk of my working life after that in senior security management, and if that career teaches you anything, it’s that most breaches aren’t clever. They’re lazy. Someone props open a fire door for a cigarette. Someone leaves the keys in a drawer because it’s quicker. Someone knows the alarm on the east fence has been playing up since spring and pops it on the list for next quarter’s budget. The attacker doesn’t need to be a genius. He just needs to be the first person to notice.

In my civilian years, I picked up the nickname Mr Memo, because I had a habit of putting things in writing and asking people to sign that they’d read them. It wasn’t popular. It was, however, enormously useful later, when Directors needed to show what had been flagged and when. I mention it because this story is a textbook case of the memo going out and nobody acting on it. Claroty sent the memo in August. CERT-FR sent it in October. ANSSI sent it with the word “immediately” in it. The memo existed. What was missing was the bit where someone with a budget signs at the bottom and then actually does something.

Look at the operational picture through a security lens, and it’s almost embarrassingly familiar. The attacks landed overnight, when stores were shut, and nobody was watching the temperature readouts, and the Sicilian incident was logged at 4am. The target was one family of controller from one supplier, much of it managed by third-party contractors, so a single weakness travelled across borders, chains and brands without breaking stride. That’s a single point of failure, and every security manager worth his lanyard is trained to spot those first.

And the front doors to these systems were, in plenty of cases, simply open to the internet. Analysis by UK Cyber Defence for The Grocer found the control systems of more than 800 UK supermarket fridges were reachable by anyone who knew where to look. On a physical site, that’s leaving the loading bay shutter up all night, every night, and acting surprised when a van finally reverses in.

The Fridge Doesn’t Need the Internet

The obvious question, and the one half the comment sections are asking with varying degrees of politeness, is why on earth a supermarket fridge is connected to the internet at all. The honest answer is that the fridge isn’t, really. The control panel is. Most cold aisles are run by a central controller that manages every fridge and freezer in the store, and that controller is online so maintenance contractors can adjust settings remotely and get an alert when something fails. Some units in France, according to local reporting, carry mobile data cards so technicians can check temperatures without ever setting foot in the shop.

There are perfectly sensible reasons for all this. Energy is expensive, refrigeration eats it, and a contractor watching a dashboard can catch a failing compressor before it costs a fortune. Fewer call-outs, smaller bills, a tidy line in the quarterly report. Nobody set out to build a vulnerability. They set out to save money and a bit of hassle, and the vulnerability came free with it.

This is the pattern I keep coming back to on this blog. We bolt remote convenience onto physical things that used to work perfectly well on their own, and then behave as though the convenience cost nothing. It doesn’t. Every remote connection is a door, and every door needs somebody looking after it for as long as the building stands. A refrigeration controller can stay screwed to a wall for years after its maker has moved on to the next model. When a manufacturer calls a product obsolete, the fridge doesn’t stop working. It just stops being looked after, while carrying on answering the door to anyone who knocks.

Paolo Falcioni of APPLiA, the European home appliances association, made the point rather well, if in more measured language than mine. Resilience, he said, gets tested at the moment remote access fails, and staff still need to be able to monitor temperatures when it does. In other words: a thermometer, and a human being walking the aisles. Revolutionary stuff.

The Excuses Department

Every incident comes with its own little festival of explanations, and this one hasn’t disappointed. My favourite so far comes from Coop in Sweden, whose spokesman said six of its roughly 800 stores were hit and that the affected shops ran on 4G rather than 5G, which made them more exposed to hackers. I’ll be polite about this. The experts quoted throughout the coverage keep pointing at the same culprits: outdated firmware, unpatched controllers and control panels left open to the internet. Which generation of mobile signal carries the knock matters a good deal less than whether anyone locked the door. Blaming 4G is a bit like blaming the colour of the getaway van.

Then there’s the manufacturer. The day after the French attack, Danfoss was heading to Chillventa in Nuremberg, a three-day refrigeration trade fair, to showcase its new iC7-HVACR drive with “integrated cybersecurity features”. I don’t think that was cynical. Trade fairs are booked months ahead, and the product was surely in the pipeline long before any of this. But you couldn’t write the timing. If I’d put it in Unharnessed, readers would have told me I’d overdone it.

And then there’s the word obsolete, doing an enormous amount of heavy lifting. Obsolete to whom? To the manufacturer’s product roadmap, certainly. Not to the shop, which was still relying on it to keep the yoghurt cold. There’s a gap between the moment a supplier stops caring about a product and the moment a customer stops depending on it, and that gap is exactly where attackers set up camp. Nobody owns it. The supplier says it told you to upgrade. The retailer says the contractor manages all that. The contractor says it was waiting for sign-off. Everybody’s covered, and the food’s in the skip.

Regulation, naturally, is on its way. The EU’s Cyber Resilience Act, agreed in 2024, makes security mandatory for internet-connected products, and one French cybersecurity expert described the slow pace of putting it into practice in France as a disaster. APPLiA wants a common European framework with practical standards. All of which is sensible, and none of which helps a Belgian shop manager staring into a cabinet of warm prawns this week.

Nobody Has Signed This One Either

At the time of writing, nobody has claimed responsibility and no government has publicly named a culprit. I’m going to resist the temptation that half the internet has already given in to, and not name one either. Attribution in cyber incidents is slow, difficult and frequently wrong when rushed, and I’ve sat through enough confident early briefings in my time to know how often the second version of a story differs from the first.

What I will say is that the silence is part of the shape of the thing. No ransom demand has surfaced publicly, and nobody has dumped stolen data online. The attack did something very simple and very visible: it emptied the cold aisles, briefly, in shops ordinary people use every day. If you wanted to test how a continent reacts, how quickly retailers notice, how long systems take to restore and whether the public gets jittery, you could hardly design a cheaper experiment.

Commissioner Hansen’s phrase about consumer confidence is the right one. Food is the most basic contract between a society and the people in it. You walk in, the milk is cold, you walk out. Wobble that, even for a morning, and people feel it in their stomachs before they’ve processed it in their heads.

Whether this turns out to be a state, a criminal gang, a bored teenager with a search engine or some unholy combination, the lesson doesn’t change much. The capability was cheap, the door was open, and the warnings were public. Who walked through it matters enormously to the diplomats. For the rest of us, the uncomfortable part is that it could have been almost anyone.

The Slack We Removed

I live off-grid in a cave dwelling in rural Spain, so I’m aware my relationship with refrigeration is not quite the European norm. The rock holds a steady temperature whatever the weather is doing outside, and it has never once asked me for a firmware update. I’m not suggesting Carrefour moves into a hillside. But there’s something worth sitting with in the gap between a system that simply works and a system that only works for as long as someone, somewhere, keeps paying attention to it.

We’ve built a food system that is extraordinarily efficient, and efficiency is mostly the art of removing slack. Fewer engineers on site, more dashboards. Fewer thermometers, more alerts. Fewer people walking the aisles at night, more contractors watching from a laptop somewhere else entirely. It all runs beautifully until the night the dashboard lies to you, and then you discover that the slack you removed was the resilience you needed.

The retailers have mostly restored their systems. The investigations will grind on. Somebody will eventually publish a report with a sensible title and a list of recommendations, and a fair few of those recommendations will look remarkably like the warnings issued in August and October. Then, I suspect, we’ll all go back to assuming the milk will be cold, because it nearly always is.

And somewhere, on a wall behind a cold aisle, an obsolete controller will carry on humming quietly to itself, still connected, still answering, waiting for the next person to knock. I’d love to tell you someone’s dealing with it. I just haven’t seen the signature.

Until Next Time