Hackers have twice targeted supermarket refrigeration systems across Europe in under a month, causing significant food spoilage and sparking concerns about the security of internet-connected devices. The attacks have led to hundreds of stores being affected, with millions of euros worth of food compromised.

On October 11 and 12, attackers manipulated refrigeration units in approximately 700 French supermarkets, raising temperatures as high as 50C (122F). This incident was later attributed by France to Shahid Kaveh, a cyberunit linked to Iran’s Islamic Revolutionary Guard Corps (IRGC), marking what officials described as the first large-scale sabotage cyberattack on French territory.

A second wave of suspected cyberattacks occurred on November 2, impacting supermarkets and food businesses in at least nine European countries, including Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal, and Sweden. The perpetrators of this second wave have not yet been identified.

These incidents highlight the growing vulnerability of internet-connected equipment, ranging from industrial machinery to everyday household appliances. Experts warn that as more devices become digitized, the potential for disruption and damage increases significantly.

Supermarket refrigeration systems are often managed through a central control panel that is connected to the internet, allowing for remote monitoring and maintenance. Similarly, home smart appliances connect via Wi-Fi, apps, or cloud services. Attackers reportedly located these vulnerable supermarket systems using Shodan, a search engine for internet-connected devices.

According to Vincent Strubel, head of France’s National Cybersecurity Agency (ANSSI), the breaches exploited basic security flaws. These included systems being directly exposed to the open internet without additional protection, the use of weak or default passwords, and the prevalence of outdated models lacking essential security updates. Once inside, hackers could manipulate temperature controls, disable units, or steal sensitive account information.

In the French attacks, hackers utilized the systems' own defrost functions to overheat the units. Security experts emphasize that poorly protected devices can serve as entry points for attackers to access other equipment on the same network, such as laptops or smart home devices.

Vincent Strubel previously cautioned the French Senate that similar equipment is used in the healthcare sector for storing critical items like vaccines and hazardous materials in research labs and pharmacies, underscoring the broader implications for essential services.