Hackers warm up fridges across Europe, spoiling food

Supermarkets in at least six European countries reported this week that their refrigerators and freezers were remotely hacked and warmed up. The incidents caused the loss of food worth millions of dollars. Sweden, Belgium, Luxembourg, Ireland, Italy, and Estonia all reported problems on Monday.

In Sweden, one supermarket said its units were set to 50 degrees Celsius, or 122 degrees Fahrenheit. In Athens, the owner of a butcher shop in the Kifisia suburb told private Greek Skai TV that a refrigeration unit was raised to 150 degrees Celsius, or 302 degrees Fahrenheit. George Boubas said his employees noticed the issue at 4 a.m. It took a technician two hours to restore control. Boubas said the meat products were not affected, but the shop switched off the Wi-Fi to the units to stop further access.

This is the second time in recent weeks that such attacks have hit the region. A similar incident affected hundreds of stores in France, Belgium, and the Netherlands. French cybersecurity investigators pointed to outdated remote control modules made by Danish company Danfoss and U.S.-based Copeland. Danfoss stated that most affected systems were older products no longer receiving software updates. Copeland identified a vulnerability in its discontinued controllers.

Katerina Mitrokotsa, a cybersecurity professor at the University of St. Gallen in Switzerland, called the event a wake-up call. She noted that businesses treat small computers like ordinary appliances. She added that a fridge does not look like a security risk, which makes it an attractive target for attackers.

Supermarkets connect their fridges to monitor temperatures around the clock, get alerts before food spoils, cut energy costs, and allow technicians to fix faults remotely. Mitrokotsa said this setup saves money and reduces waste, but every connected fridge is an entry point that needs security. Nicole Carignan, senior vice president of security and AI strategy at Darktrace, said organizations often spend on new technology while neglecting older systems that keep food cold and lights on. She said the attackers used internet-facing controllers, end-of-life firmware, and default passwords.

Liz Lloyd, the U.K. cyber minister, said the French supermarket attack exploited known vulnerabilities. She described it as a demonstration that weak passwords put organizations at risk. Richard Horne, head of the U.K. National Cyber Security Center, told reporters that the French fridges were connected directly to the internet with default passwords. His team issued warnings and contacted organizations with vulnerable technology exposed on Monday night.

Experts said there is no evidence that artificial intelligence powered the attacks. Paul Chichester, director of operations at the U.K. cyber center, said the techniques used vulnerabilities that have been present for a long period. France’s national cybersecurity agency, ANSSI, has investigated the breaches since mid-October. The agency identified compromised controllers in Danfoss AK-SM and AK-SC ranges, as well as Copeland and Dixell xweb systems. ANSSI said it is assisting potential victims in France and has been updating a security alert first published on October 12. Italian cybersecurity officials met Tuesday to discuss the incident. Thomas Regnier, a European Commission spokesperson, said the incidents are not isolated and that European nations must be prepared for such cyber events.