Italy’s cybersecurity agency has extended an urgent warning about connected refrigeration systems beyond the food industry, following attacks that disrupted supermarket fridges and freezers across Europe.
The agency’s bulletin, published on 4 November, asked organisations using cold-chain technology in any sector to check protections promptly. It also urged operators of industrial remote-control systems more broadly to review their security.
The warning follows a wave of incidents on 2 November in which refrigeration temperatures rose at shops in several countries, forcing some retailers to discard food. European Union agencies and national authorities have been sharing information about the incidents and coordinating their response.
Who carried out the attacks and why remains unknown. No one has claimed responsibility, and the European Commission has cautioned against attributing them while national investigations continue.
Stores affected across borders
Officials and company representatives said four supermarkets in Germany and six in Romania were affected. Shops in Belgium, Ireland, Italy, Sweden and other European countries also reported problems. Not every refrigeration problem reported during the period has been independently confirmed as a cyberattack.
Belgium was among the countries with substantial disruption, with several grocery chains reporting failures. Federal prosecutors have opened an investigation. In Ireland, the owner of the SuperValu chain said systems in 13 stores were affected and some chilled and frozen products had to be removed from sale.
In Sweden, the Coop chain said seven affected shops had resumed normal operations. Their refrigeration systems had been disconnected from the internet while the company reviewed its wider store network. A separate Swedish retailer, ICA, said 23 affected stores had equipment connected outside its centrally managed network.
British officials said the issue extended beyond supermarkets. The head of the National Cyber Security Centre said there had been a small number of cases in which vulnerable technology had been exploited in the UK food supply chain. Reporting also identified attempts affecting small meat-processing businesses, with limited impact.
Authorities warn against assumptions
Romania’s cybersecurity director Dan Cimpean said he did not suspect a state actor. That is an official assessment rather than a final finding. The Commission has similarly said it is for national authorities to investigate who was responsible.
On 3 November, the Commission convened an EU interinstitutional meeting with agencies including Europol and held a separate discussion with national authorities through the European Cyber Crisis Liaison Organisation Network. The aim was to share information and consider a collective response.
Italy’s government held talks with intelligence chiefs and its national cybersecurity agency. The government described the impact in Italy as limited. The agency separately said it had received an incident notification from a catering company in Tuscany and detected an attack affecting a frozen-food producer in Emilia-Romagna.
The Italian agency’s later bulletin broadened its earlier warning, which had focused on food distribution and the cold chain. It asked organisations using connected control systems to check whether administrative interfaces were directly exposed to the internet, review access and device support, and make sure operating settings and alarms were intact.
The agency said those checks should be coordinated with people responsible for the equipment and its maintenance, so security work does not itself undermine safe operation. It also warned that an insecure connection could allow unauthorised changes to settings or alarms; that is a risk assessment, not proof that every affected system was compromised in the same way.
An earlier disruption
The November incidents followed a similar attack in October that affected hundreds of shops in France. The Italian agency said outdated installations, internet-exposed management interfaces and weak authentication had played a part in that earlier incident.
Some refrigeration controls involved in the November incidents were supplied by Danish manufacturer Danfoss, which said it had been working with customers and recommended that systems should not be directly accessible from the internet. Investigators have not established that the October and November incidents were carried out by the same people.
Connected controls allow refrigeration to be monitored and maintained remotely, but their security depends on how equipment and access are managed. The latest alert underlines the need to protect those systems without assuming either that every installation is vulnerable or that a single change will eliminate the risk.
Featured image: AI-generated illustration.
