Protective responses to the refrigeration attacks in Europe

Introduction

Recent weeks have seen a wave of coordinated cyber-physical attacks targeting refrigeration systems across multiple European retail chains. These incidents have been highly visible, exploiting relatively easy, highly connected targets to maximise disruption. By striking at the heart of the food supply chain, the attackers are leveraging the direct impact on the public to create fear and uncertainty. While the outward messaging from the attackers has focused on visible disruption, there may also be unreported aspects to these incidents, such as underlying ransom threats.

Martin Riley explores the resilience aspects of the attacks and provides a checklist of steps that retail businesses can take…

Why is food and drink bearing the brunt?

Food and drink combines three things that an attacker looks for. The product is perishable. The margins are thin. And the whole operation runs against the clock.

In most of IT security, we protect confidentiality first. We worry about data being stolen. In operational technology, that priority flips. Availability and integrity come first, because the process has to keep running and keep running correctly. A supermarket fridge holds no secrets. It holds a temperature. Change that temperature overnight and you very quickly destroy the value of everything inside. There is no backup to restore from. The stock is simply gone.

The retail sector is also highly distributed and heavily outsourced. A grocer may have hundreds of stores and a manufacturer several sites, cold stores, and distribution hubs. The refrigeration and production equipment in those sites is often installed and maintained by specialist contractors. To avoid sending an engineer to every site, that equipment is connected so it can be managed remotely. That convenience has quietly created a very large, very visible attack surface that often sits outside the security team’s view.

Finally, the impact is public. Empty chilled aisles are seen by every customer. Whether the attacker is a criminal group, a hacktivist, or a state-aligned actor, disruption people can see is the point. The past 18 months have already shown how exposed this supply chain is, from M&S and Co-op in the UK to chilled distributor Peter Green Chilled and brewer Asahi in Japan. What has changed now is that attackers have gone past the IT systems and into the equipment itself.

Why is this happening at a much greater scale?

Because the targets are easy to find and the attack is easy to repeat.

Our own analysis found more than 6,000 refrigeration management panels from a single manufacturer visible on the open internet. In the UK, more than 800 refrigeration and building-control interfaces have been reported as reachable online. Many of these systems were never designed to face the internet directly. Some are running end-of-life models that the manufacturer stopped updating years ago, so no fix will ever arrive for them.

The attacks themselves have not needed anything exotic. In France, in September, attackers switched units into their own defrost cycle, and up to 700 stores lost stock in a single night. The fridges did exactly what they were built to do. The controls were simply left open.

The research was public before the attacks. Vulnerabilities in these controllers were disclosed in August, with fixes available. Defenders read that research. So did attackers. And the cost of turning published research into a working attack has collapsed. Researchers showed this year that an AI coding agent could rebuild known exploits for one of these controllers in around 28 minutes, for about six dollars. When the effort is that low and the targets are listed on public search engines, one actor can hit hundreds of sites across several countries overnight. That is exactly the pattern we have seen move from France to Sweden, Belgium, Luxembourg, Estonia, and Ireland in three weeks.

Who is ultimately the victim?

The headlines name the retailer, but the retailer is only the first link in the chain.

The manufacturer loses product and orders. Farmers and growers see stock written off further down the line. The refrigeration contractor carries the reputational damage and often the remediation bill. Insurers pick up losses that, in France alone, run into tens of millions of euros. Store staff spend the morning emptying freezers instead of serving customers.

Ultimately, the victim is the consumer. Today that means empty shelves and less choice. Over time it means cost, because losses on this scale are passed on in prices and premiums. For people who rely on a single local store, or on chilled and frozen food for health reasons, the disruption is felt more sharply.

There is a bigger point too. Food is critical infrastructure in all but name. When an attacker can spoil food across several countries in one night from a laptop, that is a food security issue, not just a retail one. I would also add the reassurance that matters. Where monitoring works, affected stock is removed before it reaches anyone. Pulling food off the shelves is the safety system working, not failing.

What can manufacturers do to protect themselves?

Manufacturers should not read this as a retail problem. Cold stores, ammonia refrigeration plants, production lines, and packaging systems follow exactly the same pattern of remotely managed, contractor-supported equipment. The good news is that the first steps are neither expensive nor complicated.

Find out what is exposed. Most organizations cannot answer a simple question today: which of our operational systems can be reached from the internet, and who can reach them? Treat this as continuous exposure management, not a one-off audit. Look at your estate the way an attacker does, from the outside in.
Take it off the open internet. This is the single fastest fix and the first instruction from France’s national cyber agency. Remote access should go through a controlled gateway with multi-factor authentication, not straight to the device.
Treat contractors and OEMs as part of your attack surface. If a third party can reach your equipment, your security is only as strong as theirs. Write security requirements into contracts. Make remote access named, time-limited, and logged.
Replace what can no longer be patched. End-of-life controllers will never be fixed. Put them on a funded replacement plan with a date and isolate them until then.
Monitor the process, not just the network. An attacker who wants to spoil product has to change a setpoint or trigger a defrost. That is the behaviour to detect. Alert on setpoint changes, logins outside maintenance windows, and temperatures drifting out of range. The retailers who limited the damage this week were the ones whose alarms caught it quickly.
Rehearse the bad night. Run an incident exercise built around an operational scenario, not just ransomware. Know who isolates the equipment, how you run manually, and when product is quarantined.

For 20 years, the industry has worried about attackers stealing data. These attacks show they are now willing to change tactics. The organizations that act now, while the consequence is wasted food rather than something worse, will be the ones that are not in next month’s headlines.