If a supermarket fridge can be hacked, the food chain is critical infrastructure

For decades, security at a supermarket meant pulling down the shutter and setting an alarm. Today something less visible has to be added: the small box that regulates the temperature of the cold rooms and that, in many cases, is connected to the internet so that the technician can check it without travelling. Over the past four weeks, that convenience has become an open door.

On the night of October 11 to 12, someone remotely triggered the defrost cycle of the refrigerators in hundreds of French supermarkets. According to AFP, at Intermarché and Netto alone at least 300 stores were affected, as well as 80 Carrefour stores and some 30 Monoprix stores. Escudo Digital reports that some cold rooms reached 50 degrees for almost six hours. Meat, fish, dairy products and frozen food had to be thrown away.

On November 2 it happened again on a wider geographical scale. EFE reports some 40 Delhaize stores and 15 Carrefour stores affected in Belgium, 13 supermarkets in Ireland and 17 businesses in the Netherlands, almost all of them butchers and small shops. Coop confirmed six stores in Sweden, and in Estonia some cold rooms also reached 50 degrees. This week, the French Blood Establishment confirmed an attack on the system that controls its refrigerated rooms, although the blood products were not affected.

No one has claimed the attacks, and no authority has publicly attributed them to a specific actor. The Kremlin has called the accusations pointing to Russia “absurd.” The European Commission has said that “these are not isolated incidents” and leaves the investigation to each country. There is no need to settle that question to draw the practical lesson. A SentinelOne analyst cited by Reuters notes that the absence of demands for money points to sabotage and that retail is an easy target because of the number of controllers it has exposed.

The most uncomfortable part is how they got in. According to Escudo Digital, the French cybersecurity agency explained that the attackers gained access through remote monitoring controllers from a single manufacturer, Danfoss, and that some were running software that had been unsupported since 2021. No sophisticated virus was needed: valid maintenance commands were enough. In the Netherlands, the manufacturer itself acknowledged that the equipment used default passwords and was connected to poorly protected networks, and that it had warned its customers in mid-October. It told AFP that most of the units attacked were old products at the end of their service life, without security updates.

Spain is not on the list. Carrefour Spain and Auchan, which owns Alcampo, said in October that their Spanish stores had not been affected. That is good news, and also a dangerous temptation: that of thinking this is someone else's problem. No one has said which controllers are running in Spanish stores or how many have unsupported software, and that is precisely the question worth asking now.

The best argument for doing nothing has its logic. A supermarket is not a power station. If a cold room fails, goods are lost, not lives, and the insurance pays. Forcing thousands of businesses, many of them small, to audit their refrigeration would be a disproportionate burden for a risk that has not materialized here. Let each company decide.

I am not convinced, for three reasons. The first is that we are no longer talking about an expired yoghurt: the same type of attack has reached the cold rooms of a blood bank. The second is that the damage is not measured in one store, but in hundreds at once and on the same night, which is exactly what turns a commercial failure into a supply problem. And the third is that what needs to be done is cheap: change the factory passwords, take off the internet whatever does not need to be connected and replace equipment that no longer receives patches.

That is why I am asking for three concrete things. That the cybersecurity authorities issue a clear alert for the food sector, with the affected models and the minimum measures. That the big chains and the manufacturers say what share of their installed base in Spain runs on unsupported equipment and how soon they will replace it. And that the refrigeration of food and medical products be treated as what it is, a piece of critical infrastructure, with an obligation to have a plan for running manually when the network fails.

The European Commissioner for Agriculture called it “a deliberate attempt to disrupt our food supply chain.” If it is deliberate, the prudent thing is not to wait for it to arrive here before closing the door. What costs little today may tomorrow cost an entire night of open cold rooms.