Supermarket fridge hack reaches Germany

A wave of cyberattacks on supermarket refrigeration that began in France has reached Germany. In the night to Monday, 2 November, chilled counters, cold rooms and freezers in several German stores stopped cooling or even began to heat up, and staff had to throw away large amounts of food. Police in Bavaria, North Rhine-Westphalia and Lower Saxony are investigating the supermarket fridge hack, which hit shops in at least ten European countries within a few weeks. Nobody has claimed responsibility.

The attacks did not target customers' data or payment systems. They went after the remotely managed controllers that keep milk, meat and frozen goods cold, a part of shop technology that most people never think about.

How the supermarket fridge hack hit German stores

One of the first German cases was an Edeka store in Reisbach in Lower Bavaria. The operator wrote on Facebook that the refrigeration had been heated to up to 50 degrees Celsius overnight. Some products were handed to the food rescue initiative Foodsharing, but most of the chilled goods had to be thrown away. According to the trade magazine Lebensmittel Praxis, the criminal police in Landshut are investigating on suspicion of data espionage and data manipulation. An Edeka spokesperson told ZDF that the equipment manufacturer was examining the cause.

In Lilienthal near Bremen, counters, cold rooms and freezers failed during the same night and warmed to about 30 degrees. Owner Daniel Breiding told the dpa news agency that his staff spent a whole day clearing out sausage, cheese, dairy and frozen products. "We had to throw away goods worth more than 360,000 euros," he said. His insurer is still checking whether it will pay. The central criminal investigation unit in Oldenburg is handling the cases in Lower Saxony, including a further one in Diepholz, and is trying to establish whether they are linked.

North Rhine-Westphalia was also affected. In Wetter-Volmarstein, a supermarket run by the welfare association Arbeiterwohlfahrt (AWO) lost large amounts of food, and the attack reportedly targeted the company that maintains its cooling systems remotely. Police in Wuppertal said goods there had spoiled after temperatures were raised remotely over the weekend. In Raesfeld in the Münsterland, an independently run Rewe store reported failing refrigeration, and police were checking whether hackers were to blame. According to dpa, a supermarket and a food business in the districts of Kaiserslautern and Kusel in Rhineland-Palatinate were also hit.

A wave that started in France

The first large attack took place in France on 12 October, when the cooling systems of hundreds of stores belonging to major chains such as Intermarché and the U cooperative were disabled. The Paris prosecutor's cybercrime unit took up the case. On 2 November a second wave followed in several countries at once. In Belgium and Luxembourg, Ahold Delhaize reported an IT incident in several dozen stores, and Carrefour counted problems in about 15 of its 700 Belgian locations. In Sweden, seven of Coop's 800 stores were affected, and in Ireland 13 SuperValu supermarkets pulled chilled and frozen food from sale.

Cases were also reported in the Netherlands, Estonia, Finland, Italy and Portugal. According to Al Jazeera, citing Reuters, more than 100 shops across Europe had overheating units on that Monday alone. The European Commission held crisis meetings with the EU cyber agency ENISA and Europol. Agriculture Commissioner Christophe Hansen called the attacks a "deliberate attempt to disrupt our food supply chain and undermine consumer confidence", but stressed that food security in Europe is not at risk.

How the attackers got into the cooling systems

Modern supermarket refrigeration is controlled by small computers that service companies can reach over the internet to adjust temperatures or start defrost cycles. In the stores hit by the supermarket fridge hack, attackers appear to have used this access to switch units into defrost mode or to set target temperatures far above zero. The Danish manufacturer Danfoss said its products were involved and that the affected devices were running older software that had not been updated. In Estonia, according to dpa, the attackers reached the control computer of an older Danfoss system.

BleepingComputer reports that a French government warning named controllers from Danfoss as well as from Copeland and its Dixell brand. Stephan Moelans, director of the Belgian refrigeration service company Sabcobel, said the attacker used the same weakness as in France. "The simplest solution is to manage the refrigerators via a secure internet connection," he told the broadcaster RTL. Awais Rashid, a cybersecurity professor at the University of Bristol, pointed to known vulnerabilities in several controllers, many of which are past the end of their supported life.

Who is behind the attacks

The people behind the supermarket fridge hack and their motives are unknown. Prosecutors in France and Belgium have opened investigations, and police in several German states are looking into the local cases. Because no ransom was demanded, experts quoted by the Bavarian broadcaster BR consider sabotage a likely motive. Some security researchers have speculated about a state-linked actor, but there is no public evidence pointing to any group or country, and authorities have not named a suspect.

In Germany, the Federal Office for Information Security (BSI) urged operators to protect control systems that can be reached from the internet in line with current standards, according to ZDF. Federal Digital Minister Karsten Wildberger called for better protection of building and operational technology. "All companies, and that includes public administration, must take more precautions," he said on Welt TV.

Supermarket fridge hack: what shoppers in Germany should know

For customers, the main risk is not empty shelves but food that has warmed up and then cooled down again. The affected German stores removed spoiled products from sale, and authorities say the supply of food is secure. Still, it makes sense to look closely at chilled and frozen goods: thick ice crystals inside packaging, soft or misshapen frozen products and pools of water at the bottom of a freezer cabinet can all be signs that the cold chain was broken. Meat, fish and dairy should feel properly cold when you pick them up.

If you buy something that turns out to be thawed or spoiled, keep the receipt and take the product back. German warranty rules, known as Gewährleistung, generally entitle you to a replacement or a refund when goods were already faulty at the time of purchase. According to an industry insider quoted by the Berliner Morgenpost, a nationwide outage is less likely in Germany than in France, because many independent retailers choose their own systems. For general advice on food shopping, see our guide to grocery shopping in Germany, and for another recent attack on IT systems in Germany, read about the Leipzig University cyberattack.