Refrigeration cyberattacks highlight risks of connecting industry to the internet

After a previous attack in France that affected hundreds of supermarkets in October, food retailers in Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands and Sweden experienced stark rises in fridge and freezer temperatures on Monday, forcing them to throw away spoilt produce.

Industrial equipment such as refrigeration systems – once operated largely offline – is now commonly connected to the internet so it can be monitored and managed remotely, cybersecurity specialists including Antoine Hautin, secretary-general of the Almond cybersecurity consultancy, told AFP.

Such connectivity can also provide an avenue for attackers to interfere with physical systems through digital networks.

Read moreFresh wave of fridge cyberattacks hits European supermarkets

Real-world effects 

The attack in France targeted a fridge regulation system made by the Danish firm Danfoss, which is used by many shops.

To display this content from YouTube, you must enable advertisement tracking and audience measurement.

One of your browser extensions seems to be blocking the video player from loading. To watch this content, you may need to disable it on this site.

"Most of the time, that's done through a web interface. You connect to it with a password and you then have the possibility to choose what the temperature in the fridge is," said Kevin Tellier, cybersecurity engineer at Synacktiv.

While these systems "are normally on a closed network" and "are not supposed to be accessible from the Internet", a number of them ended up being exposed "to anyone with some basic knowledge", he added.

Without proper protections, "any factory or equipment" connected to the internet – ranging from carmakers to electricity or transport infrastructure – could face similar risks, said Olivier Daloy, a cybersecurity expert at Zscaler.

How was it done?

According to another cyber expert who requested anonymity, industrial infrastructure is particularly vulnerable because it links IT systems with oft-outdated physical equipment.

By infiltrating those IT systems, hackers can hijack that infrastructure and cause disruption in the real world.

Daloy highlighted two particular risks: the exploitation of a technical vulnerability and the use of compromised credentials allowing hackers to log in to the equipment.

Read moreEU, UK slap sanctions on Russian spies and hackers over cyberattacks

He pointed to the Stuxnet virus in 2010, which caused a series of failures in Iran's centrifuge fleet used for uranium enrichment, as a past example.

In France, the October cyberattack was made possible by "basic security shortcomings", according to Vincent Strubel, head of France's National Cybersecurity Agency.

In particular, he blamed the fridges' "direct exposure to the internet ... without any particular security and with weak passwords".

Who could be behind it?

Figuring out who could be behind the attack in France is "extremely complicated", Daloy said.

Tellier agreed. "It could be anybody. The attack was not extremely sophisticated, so we cannot determine whether the hackers have significant resources or not."

One security source told AFP that the investigation into the breach will "extend far after the event itself".

A 2025 French national security document identified such attacks as "one of the threats that must be treated as a priority".

"These incidents highlight how vulnerable food supply chains are to cyberattacks," with far-reaching consequences, the document said.

To display this content from YouTube, you must enable advertisement tracking and audience measurement.

One of your browser extensions seems to be blocking the video player from loading. To watch this content, you may need to disable it on this site.

(FRANCE 24 with AFP)