{"id":10283,"date":"2026-11-03T00:23:35","date_gmt":"2026-11-03T00:23:35","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=10283"},"modified":"2026-11-03T00:23:35","modified_gmt":"2026-11-03T00:23:35","slug":"european-supermarkets-that-failed-to-act-after-french-freezer-attack-are-now-feeling-the-heat","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=10283","title":{"rendered":"European supermarkets that failed to act after French freezer attack are now feeling the heat"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

Just a couple of weeks after a cyberattack on French supermarket refrigeration systems resulted in spoiled food, and even some fires, retailers in Belgium, Ireland, Sweden, Finland, and Estonia were hit with nearly-identical attacks on Monday.<\/p>\n

The mid-October attack<\/a> prompted an advisory from the French Computer Emergency Response Team (CERT-FR) recommending that organizations disconnect any refrigeration control systems with public IP addresses from the internet, and to reconnect them via a secure VPN only after verifying the configuration and, if necessary, restoring factory defaults.<\/p>\n

In an emergency, the advisory suggested, organizations could simply filter connections to allow only the IP addresses of their refrigeration suppliers or service providers to connect, but this should not be a long-term solution.<\/p>\n

The Monday attack, like the one in October, \u201cresulted in sudden changes in the temperatures of their fridges and freezers,\u201d according to a Bloomberg report<\/a>, which confirmed incidents with impacted retailers, including Carrefour, Spar, and Ahold Delhaize. No group has as yet claimed to be behind the attacks.<\/p>\n

A spokesman for Ahold Delhaize told CSO, \u201cOn Monday, November 2, we identified an incident affecting refrigeration systems in dozens of Delhaize stores. We immediately took the necessary measures to limit the impact and keep the stores operational.\u201d The situation has since returned to normal, although the company had to discard valuable food, he said. <\/p>\n

Delay understandable<\/h2>\n

Analysts and consultants said the lack of an immediate response to the initial refrigeration attacks is understandable, given the complex nature of the systems and the multiple vendors who typically manage such systems for major retailers.\u00a0<\/p>\n

Gartner Distinguished VP Analyst Katell Thielemann<\/a> said that although the impacted European retailers own the hardware, they outsource the maintenance, upkeep, and the management. Thus, she said, \u201cthere is some confusion about who owns what in this black box of outsourcing.\u201d<\/p>\n

IDC Senior Research Manager Bobby Kuzma<\/a> agreed.\u00a0<\/p>\n

\u201cThere\u2019s a huge gap in visibility between the folks who monitor threat intelligence and vulnerability reports, and the people who manage the OT\/industrial side of the universe,\u201d he said. \u201cThe cybersecurity teams may not have even been aware that the devices were network connected, especially if they were riding on dedicated internet circuits for manufacturer support.\u201d<\/p>\n

Thielemann added that the incident was made worse because of the historic lack of priority given to cybersecurity defenses in retail.\u00a0<\/p>\n

\u201cIt\u2019s proof that cybersecurity is still not top of mind,\u201d she said. \u201cEven when it\u2019s so egregious, senior [retail] leaders are not asking, \u2018How do we get ahead of this?\u2019\u201d<\/p>\n

However, Kuzma argued, this problem comes down to asset inventory visibility.\u00a0<\/p>\n

\u201cYou can\u2019t protect a system that you don\u2019t know you have. You can\u2019t scan for exposures on a connection that you don\u2019t know exists,\u201d he pointed out. \u201cSometimes that inventory requires somebody physically going into the telco closet at the locations and asking pointed questions about equipment that\u2019s present. In this day and age, having devices of any type hanging off a public internet connection and accessible is asking for trouble.\u201d<\/p>\n

IoT handled outside of IT<\/h2>\n

David Neuman<\/a>, an executive advisor with consulting firm Acceligence, also noted that it was never realistic to assume that issuing a cybersecurity advisory was going to meaningfully address this security hole.<\/p>\n

\u201cAn advisory doesn\u2019t fix a system nobody in the building owns,\u201d Neuman said. \u201cContractors often install and service store refrigeration controllers under arrangements that rely on a constant data feed, so they can sit outside the security team\u2019s inventory and authority. Taking the controllers offline means finding them, then reworking how the contractor gets in, store by store.\u201d <\/p>\n

That, he said, \u201cexplains the gap, but it doesn\u2019t excuse it: France gave everyone a three-week warning. Abusing a legitimate function like defrost causes physical and financial damage without any malware.\u201d<\/p>\n

Brian Levine<\/a>, a partner at consulting firm Control Risks, added that another part of the problem is that IoT<\/a> devices have always been handled outside of IT.\u00a0<\/p>\n

\u201cFor years, organizations treated connected operational equipment as a facilities issue. These incidents end that debate,\u201d Levine said. \u201cSecurity professionals never dismissed this risk; budgets deprioritized it because nothing had failed at scale. Now it has, and boards will ask why vendor contracts, incident response plans, and tabletop exercises never accounted for a physical outcome.\u201d<\/p>\n

And, said Noah Kenney<\/a>, principal consultant at Digital 520, this issue goes beyond the fact that the attackers could gain access. He said that he is most concerned about the range of things the attackers were able to do with that access.\u00a0<\/p>\n

\u201cThe attackers could reportedly manipulate refrigeration systems to operate far outside their intended parameters,\u201d Kenney said. \u201cEven if someone gains access to a system, there should be independent safeguards preventing commands that could damage equipment or disrupt operations. The fact that remote access can potentially translate into physical damage suggests some serious gaps in how these systems are designed and secured.\u201d<\/p>\n

Kenney also noted that some of these devices had long passed their end-of-life, meaning that security patches and other upgrades may have been unavailable.\u00a0\u201cOrganizations can end up relying on equipment that still functions perfectly well operationally, but can no longer be adequately secured,\u201d he pointed out. \u201cThat creates difficult decisions about network isolation, compensating controls, and ultimately when equipment needs to be replaced.\u201d<\/p>\n

Indeed, said independent technology analyst Carmi Levy<\/a>, some in IT tend to ignore IoT systems, especially when they were deployed by functional units without permission from IT or cybersecurity teams.<\/p>\n

\u201cEnterprises don\u2019t tend to look at fridges in the same light as servers, smartphones, and other traditionally connected devices,\u201d he noted. \u201cIf anything, most IT shops have a limited view of what constitutes a connected device in the first place. That means many organizations are running connected devices, such as appliances, floor cleaners and once-dumb but now increasingly smart machines, with dangerously outdated firmware because they never identified them as connected in the first place.\u201d<\/p>\n

Unexpected threat to IT<\/h2>\n

As well, said Frank Dickson<\/a>, principal analyst at Dickson Research, there are also corporate legal issues that may undercut cybersecurity\u2019s need for quick action.\u00a0\u00a0<\/p>\n

\u201cCERT-FR\u2019s own alert shows why that takes time. Before cutting a controller off the internet, it tells operators to check the insurance terms in their contract with the refrigeration provider. That one line says a lot,\u201d he said, adding that many of these controllers are installed, monitored, and guaranteed by a contractor who depends on the data feed. The store may have neither the ability nor the authority to shut them down. <\/p>\n

\u201cThree weeks of warning is a long time for an attacker and a short time for a supermarket chain. Close the door to the internet first and renegotiate the contracts second,\u201d he said.<\/p>\n

Dickson also argued that these refrigeration attacks pose an unexpected threat to traditional IT systems as well, because servers and other equipment are temperature-sensitive.<\/p>\n

\u201cAn attacker who reaches the building management system does not need to touch a single server. The servers will shut themselves down rather than cook,\u201d Dickson said. \u201cYou do not need to hack the data center. You only need to hack the air conditioning.\u201d<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

Just a couple of weeks after a cyberattack on French supermarket refrigeration systems resulted in spoiled food, and even some fires, retailers in Belgium, Ireland, Sweden, Finland, and Estonia were hit with nearly-identical attacks on Monday. The mid-October attack prompted an advisory from the French Computer Emergency Response Team (CERT-FR) recommending that organizations disconnect any […]<\/p>\n","protected":false},"author":0,"featured_media":10267,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-10283","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10283"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10283"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10283\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/10267"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10283"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10283"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10283"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}