Hackers turned supermarket smart-fridges into heaters & no law makes them fix it

Summary

Louis Rossmann discusses cyberattacks on supermarket refrigeration systems in Europe. In attacks reported from October into November, hackers accessed internet-connected fridge and freezer controllers, then raised temperature settings or activated defrost mode. In Sweden and Estonia, some settings were reportedly changed to 50°C; in Belgium, some units were put into defrost mode. Shops in multiple countries had to discard food they could not verify was still safe. Reported losses included €100,000 worth of food at one Belgian supermarket and an estimated €15,000 of meat at a butcher’s shop.

Rossmann argues that connecting refrigeration systems to the internet creates risks that outweigh the convenience of remote monitoring and maintenance. He stresses that grocery stores and small food businesses should not be expected to employ IT specialists to secure equipment whose basic purpose is to keep food cold.

He also raises a hypothetical risk: an attacker might manipulate temperatures so food appears cold again by opening time, even though it was held at unsafe temperatures overnight. He presents this as a possible danger, not as something established in the reported attacks.

The video cites recurring security weaknesses, including controllers exposed directly to the internet, weak or factory-default passwords, and older equipment that no longer receives security updates. A Belgian cybersecurity agency had advised shops to remove controllers from the open internet or access them only through protected networks or VPNs. Some businesses and suppliers reportedly took steps to secure their systems after the first attacks, while shops that had not completed that work were among those hit later. No attacker had been identified at the time of the report.

Rossmann emphasizes that many affected controllers were already considered end-of-life and had no available patches. He says the EU Cyber Resilience Act is due to impose support-period and vulnerability-handling requirements from December 2027, but will not require manufacturers to fix the older or unsupported controllers involved in these incidents. He also notes that insurance coverage for spoiled food is uncertain and varies by policy.

He concludes that, for supermarket refrigeration, the security and food-safety risks of internet connectivity may outweigh the benefits, and recommends disconnecting the equipment from the internet.

Presenters and Contributors

• Presenter: Louis Rossmann.
• Named people cited: Kevin Bowman, security researcher; Vincent Strubel, head of France’s National Cyber Security Agency; Steven Mansen, Sabcoel chief executive; Jan Mutzo, refrigeration-industry representative; and Luke Delayat, a Belgian butcher-chain owner, as rendered in the subtitles.
• Unnamed contributors cited: A supermarket manager in southern Sweden; spokespeople for Danfoss and ICA; and representatives of Belgian and other European food businesses and agencies.