The cyber attack that affected supermarket refrigeration systems in many European countries on November 2 exposed risks related to industrial equipment connected to the Internet.

After the attack in France in October, many supermarket chains in Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands and Sweden continued to experience sharp increases in refrigerator and freezer temperatures on November 2, forcing them to throw away spoiled food.

Dozens of stores in Belgium and Luxembourg of Ahold Delhaize group (Netherlands) are affected. Colruyt Group announced that 5 Spar stores in Belgium have become targets. Carrefour supermarket (France) recorded 15 stores in Belgium being attacked. IKEA confirmed that a cyber incident affected refrigerators and freezers at its store in Mons (Belgium). In Sweden, the country's largest retailer ICA said the refrigeration system at some stores had problems. Similar disruptions also occurred at the Kesko (Finland), Supervalu (Ireland) and One Selver (Estonia) chains.

According to expert Antoine Hautin at cybersecurity consulting firm Almond, industrial equipment such as refrigerators, which previously operated mainly offline, are now connected to the Internet for remote monitoring.

An August study by cybersecurity firm Claroty describes a refrigerator management system that allows operators to monitor multiple units at once, adjust temperature settings, review alarms and perform maintenance through a web interface. Such a platform can easily coordinate dozens of units in different locations, without needing employees to waste time going directly to check.

In analysis published in October, the research team at Vedere Laboratory of cybersecurity company Forescout showed that attackers could take advantage of refrigerator control systems to cause financial damage and disrupt operations without using malicious code. In France, hackers targeted the refrigerator control system of the Danish company Danfoss, which is used by many stores.

"Usually, users manage through a website. Just log in with a password and you can freely adjust the refrigerator temperature," Kevin Tellier, a cybersecurity engineer at the company Synacktiv, explained to AFP. He added that although the system runs over a secure internal network and is not connected to the Internet, the reality is that vulnerabilities on many devices allow anyone with a little basic knowledge to access it.

Commercial refrigerator control systems include operational technology (OT) - computer hardware and software used to monitor, control and manage industrial operations. OT security is important because if unauthorized intervention occurs, it can directly change the way the device operates.

Research published in December 2025 by the British Ministry of Science, Innovation and Technology points out many weaknesses: outdated equipment, poor asset management and risks from third-party suppliers. Through interviewing 30 people and reviewing reports, the study concluded that many legacy operating systems were not designed for network connectivity. Connecting them to the corporate network for monitoring and management can open the way for hackers to attack.

According to Xinhua, exposing the admin page on the public Internet and not updating security software also makes the device an easy target for hackers. Researchers from security company Claroty discovered that some refrigerator systems use an administration page that can be accessed directly over the Internet. They also found a series of security vulnerabilities in the refrigerator controller. The manufacturer has released an update to fix those vulnerabilities, but operators need to install it on the affected device.

Reuters said European supermarkets affected by the second cyber attack are rushing to upgrade their systems. In Sweden, the Coop supermarket chain has switched its system to a 5G network and modern modem instead of 4G connection. Seven stores have reopened but their refrigerator systems have been disconnected from the Internet.

"Retailers need to act now. They need to identify vulnerable refrigerator controllers, check that they are connected to the Internet, ensure the latest security updates with support from the manufacturer," said Frank Groenewegen, cybersecurity expert at Deloitte in The Hague. "Disconnecting does not completely solve the problem, but at least helps isolate the system so hackers cannot continue to attack."

According to Richard Horne, CEO of the UK National Cyber ​​Security Center (NCSC), the attack on supermarket refrigerators was only the first warning sign. In the future, such interruptions will appear more and more often, not only with refrigerators but also with any other smart industrial equipment, when old technology is no longer enough to fight hackers.

"We need to understand that this is not because AI has found new ways to attack, but because vulnerabilities that have been ignored for too long can now be discovered and exploited at an unprecedented scale," Horne emphasized.

An Khang summary