At least 11 European countries have reported incidents involving supermarket refrigeration systems; in Estonia, one Selver shop is confirmed to have been targeted, although a refrigeration company says other clients may also have been affected.
The attackers accessed a computer used to control a shop’s refrigeration system and changed its temperature settings. At the affected Selver, a freezer setting was raised to 50°C (122°F). The intrusion was detected and stopped quickly, before it caused damage to goods.
Selver said the incident took place at one of its outlets, the last in its chain still using an older refrigeration control system. Estonia’s State Information System Authority said it had received one report, from Selver, and had heard of no other incidents. Kitman Coldtech, Selver’s refrigeration partner, had earlier said other Estonian clients were also targeted, but no additional shops have been publicly confirmed.
The reported incidents have spread across Europe. The latest tally puts the number of affected countries at least 11, after Romania, Germany and the UK joined earlier reports from countries including Estonia, Sweden and Belgium. The tally includes reports that are still being investigated, and accounts may differ as more information emerges.
The latest wave follows a major incident in France last month, when attackers manipulated refrigeration systems at hundreds of supermarkets. The resulting food losses were estimated at tens of millions of euros. In the more recent incidents, some stores in Sweden and Belgium had to remove chilled and frozen products from sale.
Commercial refrigeration systems are increasingly monitored and controlled remotely. That allows retailers to manage equipment across many locations, but it can also give attackers a way in if controllers are exposed to the internet or poorly protected. Unlike office computers, industrial equipment can remain in service for years without software updates, partly because taking it offline can disrupt operations.
The Estonian incident involved an older Danfoss refrigeration control system. Kitman Coldtech said the method resembled attacks reported elsewhere, but any connection between the incidents has yet to be confirmed.
No group has claimed responsibility, and the motive remains unknown. The State Information System Authority has said that exposed, vulnerable devices are a key risk in such attacks. The Refrigeration Association of Estonia has urged operators to check that controls cannot be accessed openly online, update software, change default passwords and review remote access.
