The striking thing about the attacks on European supermarket refrigeration is how little was required. No new technique has been described, no unknown flaw, no novel tooling. What the attackers found was equipment that was already reachable.
How a supermarket fridge is actually run
Bristol University’s professor of cybersecurity, Awais Rashid, has set out the shape of the problem. Supermarket refrigeration is typically managed remotely, and frequently not by the retailer at all but by a third-party contractor. To make that possible, the controllers are connected in a way that can be reached over the internet — and in many cases they are not kept up to date.
He went further on two points that turn an awkward design into an open door. A good number of the controllers in service are past end of life, meaning the manufacturer no longer issues fixes for them. And the passwords protecting them, in his description, are easily guessable.
Portugal’s Mosqueteiros group, whose seven Intermarché stores were affected, described exactly that structure from the inside: the attack “appears to have targeted an external service provider responsible for managing the refrigeration systems”.
One supplier keeps appearing
Control systems from Danfoss recur through the accounts. In Sweden, Ica’s spokesperson Helena Johansson said the affected stores were linked to a Danfoss control system. In Estonia, Jann Mutso of Kitman Coldtech said the units involved were older Danfoss equipment, similar to what was targeted in France.
Danfoss itself has made a recommendation that reads as an admission about how its products are being deployed: systems of this kind should not be directly accessible over the internet.
What the retailers are now doing
Sweden’s Coop gives the clearest picture of the response. Its spokesman Carlos Cancino confirmed the incident and pointed at something specific: the affected shops were running on 4G rather than 5G, which he said left them more exposed. Seven of its stores are back in service with their refrigeration disconnected from the internet entirely, and the chain is moving to 5G and modern modems — a programme it began after the French attacks, not after this one.
Germany’s Edeka illustrates the opposite difficulty. A store in Reisbach was hit, and the company noted that its network of independently run shops has no standardised refrigeration systems. There is no single fix to apply, because there is no single system.
The advice, and its limits
Frank Groenewegen of Deloitte in The Hague told retailers to establish whether their refrigeration controllers are vulnerable and internet-connected. For those who cannot answer: “If they don’t even know, then remove them from the public internet immediately.”
He was careful about what that buys. Disconnecting a system isolates it. It does not repair the underlying weakness, and the moment the connection returns, so does the exposure.
Paolo Falcioni, director general of the home appliances association APPLiA, raised the question from the other direction — what happens to the cold chain when the remote link is the thing that fails: “If remote access is disrupted, can staff still check temperatures and act to protect the cold chain?” He has called for a common European cybersecurity framework for connected products.
Why this will not be the last of it
NCSC chief executive Richard Horne described the supermarket attacks as “just an early sign”, with disruption likely to become more frequent as old technology fails to keep pace with the people attacking it. That is the uncomfortable centre of this story. The equipment at fault is not exotic. It is ordinary commercial refrigeration control, installed by the thousand, bought years ago, wired to the internet for convenience, and still running.
