When a cyberattack struck refrigeration systems at dozens of Belgian supermarkets in late October, the immediate damage was measured in spoiled food and lost revenue. Around 40 Delhaize stores, at least 15 Carrefour outlets, five Spar shops, and the butchery group De Laet en Van Haver were affected. Belgian media reported fridge temperatures soaring as high as 70°C, forcing retailers to discard tens of thousands of euros' worth of perishable goods.
The incident followed a similar attack on 12 October that disrupted refrigeration at hundreds of French supermarkets. Swedish chain ICA also reported problems at several stores. These events highlight a growing vulnerability in the continent's food supply chain: the humble supermarket fridge is now an internet-connected device, and often a poorly protected one.
Why are fridges online?
Modern supermarket refrigeration is managed by central control units that regulate temperatures, defrost cycles, and alarms for every chiller and freezer in a store. Connecting these units to the internet has been a standard option for years, according to research published in October by cybersecurity firm Forescout. It allows contractors to diagnose faults and adjust settings remotely, avoiding costly and time-consuming site visits.
Danfoss, a major supplier of such systems in Europe, says remote connectivity typically cuts unnecessary engineer callouts by 15 to 30%. It also enables automatic logging of temperature records required under food safety regulations, replacing manual checks that staff might otherwise perform up to four times a day.
Manufacturers' installation guides even describe how to expose the systems to the internet, for example by configuring a store's router to forward traffic to the refrigeration controller. The problem, Forescout notes, is that responsibility is often fragmented: a contractor manages the software, the store owns the hardware, and the IT department runs the network. Unless roles are clearly defined, "no single party may have complete visibility into the exposed service," the researchers wrote.
Age compounds the issue. One of the Danfoss controllers involved has been out of support since May 2021, meaning it no longer receives security updates and remains vulnerable to external attacks.
Scale of exposure
Using Shodan, a search engine that indexes internet-connected devices, Forescout identified 12,976 exposed refrigeration management services on 6,017 IP addresses across 99 countries. Most belonged to two product families: Copeland and Dixell's XWEB systems (7,075) and Danfoss's StoreView (4,697). Of the Danfoss services, 80% were running firmware older than the version that fixes known security flaws.
The risk extends far beyond supermarkets. The same systems are used in food processing plants, wineries, fruit storage facilities, farms, and hospital cooling equipment. Attackers do not need sophisticated malware; they can use the system's normal functions to change temperatures, trigger defrost cycles, or disable alarms—actions that can easily pass as routine maintenance.
Forescout's primary recommendation is to remove refrigeration management systems from the open internet and grant contractors access only through secure remote access tools. For European retailers, the recent attacks serve as a stark reminder that convenience must be balanced against security. As the continent's food supply chains become more digitised, the humble fridge has become a potential entry point for cybercriminals—and a reminder that the internet of things is only as secure as its weakest link.
