Listen to the article
State-backed hackers may be behind a wave of cyberattacks targeting supermarket refrigeration systems across Europe in a calculated demonstration of their ability to cripple critical infrastructure, cybersecurity experts have warned.
Xavier Bellekens, chief executive of cyberdefence company Lupovis, said the scale, coordination and technical knowledge involved suggested a sophisticated operation rather than an opportunistic attack by an amateur hacker.
His assessment follows the discovery that attackers had apparently spent ten days probing vulnerable refrigeration equipment before hundreds of supermarkets were disrupted across several European countries.
Lupovis recorded 256 attempted intrusions from 91 sources between October 20 and 30, targeting digital decoys designed to resemble Danfoss refrigeration controllers used by supermarkets.
Bellekens told BBC Radio 4’s Today programme on Wednesday that the attackers would have needed to identify exposed equipment, understand industrial refrigeration cycles and coordinate their activities across national borders.
“The coordination across all the European countries, the fact all of these devices were probed for ten days before the attack, not only is it coordination, it’s a planned attack. It requires a lot more insight into those technologies as well.”
Bellekens also raised the possibility of Russian state-linked involvement, pointing to infrastructure previously associated with such groups. He suggested the operation may have been intended to demonstrate the ability to disrupt Europe’s food supply rather than simply destroy refrigerated goods.
Jon Muir, who leads the cyber division at Collective Defence, told National Security News that the attacks exposed a dangerous combination of weak security and deliberate planning.
Collective Defence combines advanced cybersecurity and artificial intelligence capabilities to protect governments, businesses and critical infrastructure against state-sponsored cyberattacks and hybrid threats.
“What worries me is the combination of simple entry and careful execution. The attackers didn’t need custom malware. They got in through equipment left online with weak passwords.”
Muir said the attackers appeared to have deliberately targeted supermarket systems when stores were largely unattended.
“But they hit hundreds of stores across five competing chains on the same night, at a time when nobody was there to notice. That takes reconnaissance, patience and intent.”
The attacks have raised concerns about the security of industrial control systems used beyond the retail sector, including hospitals, warehouses, manufacturing facilities and other essential services.
Muir warned that British companies should not assume the threat was confined to other European countries.
“UK businesses should not assume this is a French only problem. The same kind of systems run cold stores, warehouses, hospitals and factories across the UK, and many are still exposed. The barrier to entry is low and the potential for real-world harm is high. That is the threat we now face.”
The latest incidents affected retailers in Belgium, Sweden, Ireland, Luxembourg and other European countries, following an earlier attack on French supermarkets in October.
Hackers remotely manipulated refrigeration controls, in some cases raising temperatures to 50°C and forcing retailers to dispose of spoiled food.
In Britain, west London organic food wholesaler Langridge Organic, which supplies Whole Foods Market, Riverford and Abel & Cole, was also targeted.
Hackers compromised six of the company’s ten cold-room refrigeration systems, remotely activating defrost cycles, setting maximum temperatures to 66°C and disabling automatic warnings.
Managing director Alex Pearce discovered the intrusion at approximately 5.30am on Monday after noticing two refrigeration units behaving unusually. As he investigated, a third began defrosting, prompting him to disconnect the equipment from the internet.
No food was lost because staff carried out regular manual temperature checks.
Several British meat suppliers were also affected, with hackers manipulating refrigeration equipment running Dixell XWEB software. In one case, equipment was instructed to defrost every hour, while another supplier reported temperature settings equivalent to approximately 38°C.
The Association of Independent Meat Suppliers urged members to check their equipment but said it was unclear whether any meat had been destroyed.
Investigators have yet to identify those responsible. Two pro-Russian hacktivist groups, NoName057(16) and Z-Pentest Alliance, have reportedly claimed involvement, although their claims remain unverified.
Bellekens said Lupovis had traced some of the suspicious activity to so-called bulletproof hosting providers, which can be used by cybercriminals to conceal their operations and resist requests from law enforcement.
Researchers identified hosting infrastructure in Russia, the Netherlands and Germany, including services previously associated with Russian-linked cyber operations.
“We have seen those bulletproof hosting [providers] in the past being used by Russian adversaries and Russian threat groups,” Bellekens told Radio 4.
However, the use of such infrastructure does not establish that Russia or any state-sponsored group directed the attacks.
The incidents have also exposed longstanding weaknesses in equipment that companies routinely connect to the internet for remote maintenance and monitoring.
Muir said businesses needed to begin by identifying which operational systems were publicly accessible, particularly refrigeration, heating and building controls that may not be included in conventional cybersecurity assessments.
Companies should remove unnecessary internet connections, restrict remote access, replace default passwords and update outdated software, he said.
He also highlighted the risks created by third-party contractors responsible for installing and maintaining industrial equipment.
“Installers and maintenance firms often set up remote access and then forget about it, and that becomes your risk.”
Muir said companies also needed effective monitoring capable of detecting unusual activity before equipment was damaged or operations disrupted.
“If the temperature can jump to 50 degrees without anyone being alerted, that is a business failure as much as a security one.”
The warnings come as the NCSC has urged British organisations to address weaknesses in ageing technology and industrial control systems.
Speaking at the launch of the agency’s annual cyber report on Tuesday, NCSC chief executive Richard Horne warned that years of underinvestment had left essential services increasingly vulnerable to disruption.
The agency has been contacting British organisations with exposed technology and working with affected businesses to prevent further attacks.
