Global Cyberattacks Target Supermarket Fridges, Spoiling Food in Europe and U.S.

Key points

• Attackers remotely manipulated refrigeration controllers, forcing freezers into defrost mode or raising temperatures to 50°C, spoiling food in France, Belgium, Sweden, Ireland, Estonia, and the U.S.
• The U.S. Defense Commissary Agency reported outages at at least nine military bases in August, with investigators treating the incidents as cyberattacks linked to Iran, though confidence is low.
• French cybersecurity agency ANSSI and Belgian authorities are investigating the October and November attacks, which affected chains including Intermarché, Carrefour, and Delhaize.
• Vulnerabilities stem from outdated Danfoss and Copeland controllers connected to the internet without proper security patches or firewalls.
• Experts warn that similar attacks could target temperature-sensitive drugs and laboratory materials, highlighting broader risks to critical infrastructure.

Background

This incident follows a pattern of escalating cyberattacks on critical infrastructure, including water treatment plants in the U.S. in 2023 and 2026. The attacks exploit the growing trend of connecting industrial operational technology to the internet for remote management, often without adequate security measures. Previous coverage noted concerns over AI infrastructure security and geopolitical tensions, but this specific campaign targets food supply chains, marking a shift in attack vectors.

How outlets are covering it

NPR attributes the attacks to Iranian military hackers known as Cyber Isnaad Front, citing forensic evidence and propaganda videos. The Guardian suggests state-based signaling or lone-wolf hackers, noting the simplicity of the hack and lack of ransom demands. The Hacker News emphasizes the technical vulnerabilities in Danfoss systems and the lack of official attribution, highlighting the difficulty in determining the culprit. U.S. officials suspect Iran but lack high confidence, while European authorities focus on mitigating risks through software updates and network isolation.

Why it matters

These attacks expose critical vulnerabilities in global food supply chains and critical infrastructure, potentially leading to economic losses and public health risks. They underscore the need for governments and companies to secure aging industrial systems and adopt robust cybersecurity measures to prevent future disruptions.

What to watch

Investigations by ANSSI, Belgian prosecutors, and U.S. authorities will continue to determine the attackers' identity. Companies are advised to update firmware, isolate vulnerable devices from the internet, and implement secure VPNs. Experts warn that similar attacks may target other critical systems, such as water treatment and medical facilities, in the coming months.