Share
A wave of coordinated cyber attacks targeting refrigeration systems across Europe has ruined millions of euros worth of perishable goods, exposing security vulnerabilities in the associated commercial infrastructure.
From weeks of secret investigation to suspicion pro-Russian hacktivists and impact on the UK food supply chain, here we look at exactly what happened and what it means for the future of connected infrastructure.
1. The attacks: How hackers targeted supermarket refrigerators
In early November, supermarkets and food retailers across at least nine European nations – next to various blood banks in France – suffer a synchronized cyber disruption. Hackers have remote access to the Internet Danfoss AK-SM Refrigeration System Manager and malicious temperature settings, forcing units into defrost mode and turning temperatures as high as 50°C (121°F) to 55°C (131°F). The sudden heat spoiled massive quantities of frozen goods and forced grocers to throw out ruined stocks.
2. Weeks of secret reconnaissance
According to cyber security company Lupovis, the attacks were preceded by a heavy, targeted wave of scanning and reconnaissance. Between October 20 and 30, Lupovis recorded over 276 examination attempts from 91 distinct threat actors, with activity peaking sharply on October 26 before stopping immediately before the attack. Hackers tested standard administrative credentials, such as the default factory-set username “Supervisor” and password “12345”, and searched for known vulnerabilities on Danfoss controllers exposed directly to the open Internet without virtual private networks (VPNs).
3. Impact on the UK food supply chain
The disruption quickly crossed the Channel, affecting businesses in the UK food supply chain. Those National Cyber Security Center (NCSC) confirmed it was aware of “several cases where vulnerable technology has been exploited in the UK”, with CEO Dr Richard Horne noting that teams worked through the night to alert vulnerable organisations. Meanwhile, the British Association of Independent Meat Suppliers (AIMS) reported that some of its more than 300 members were unexpectedly “harmed” in the flash attacks.
4. Who was behind it? Kremlin denials vs hacktivist claims
The identity of the perpetrators behind the Frigo cyberattacks remains heavily debated amid conflict and official denials. Initially, pro-Russian hacktivist groups NoName057(16) and Z-Pentest Alliance claim joint responsibilityy for the disturbances on Telegram before subsequently deleting the posts, while the cyber security company Lupovis noted that “bulletproof hosting” infrastructure previously used by Russian actors was observed during the reconnaissance phase.
In response, the Kremlin strongly dismissed any suggestion of state involvement, with spokesman Dmitry Peskov characterizing the allegations as absurd claims supported by absolutely no reasoning or evidence.
Meanwhile, independent cybersecurity researchers also remain skeptical, warning that groups like NoName057(16) are simply trying to capitalize on high-profile incidents for publicity. Other analysts emphasize that because the hackers relied on basic default passwords and unpatched login pages rather than sophisticated malware, the responsible party could be a group of unqualified individuals.
5. Why these systems were vulnerable
Experts point out that the retail sector has historically prioritized securing overt digital assets such as payment systems and customer databases, while treating connected physical equipment as an afterthought. Many building controllers and cooling units are directly exposed to the open Internet instead of being safely isolated behind VPNs. Furthermore, organizations often actively abandon default manufacturer passwords and delegate physical equipment management to facilities teams rather than corporate cybersecurity departments, creating an overlooked attack surface.
6. Could other connected infrastructure be next?
Security experts warn that supermarket freezers are just the most visible example of a much wider class of vulnerable connected devices. The same small Internet-connected controller used to adjust temperatures, also control building access control readers, surveillance cameras, fire alarms, interior lighting and Heating and ventilation systems (HVAC) across offices, hospitals and data centers. In these environments, a similar compromise can open doors, disable cameras, or set off alarms without spoiling stock to provide an immediate warning.
7. The threat of AI-accelerated attacks moving forward
As organizations struggle to verify their physical security postures, experts warn that the threat landscape is rapidly evolving. Artificial intelligence tools are drastically breaking down the time frame required to detect device vulnerabilities and turn them into functional cyber attacks.
Going forward, security specialists argue that organizations cannot rely solely on periodic software patches or perimeter defenses; connected physical devices must be engineered with runtime self-defense capabilities to block autonomous anomalous behavior regardless of whether a patch has been issued.
Related posts
Discover more from Tech Digest
Subscribe to get the latest posts sent to your email.