Italy’s government held emergency talks with intelligence officials on 3 November after cyberattacks disrupted supermarket refrigeration systems in at least 11 European countries. The incidents forced retailers to discard food, but responsibility and the motive remain unknown.
The attacks affected supermarkets in at least 10 European Union countries, including Italy, Germany and the Netherlands, as well as the United Kingdom. European authorities are investigating whether the incidents form part of a coordinated attempt to disrupt the food supply chain, while cybersecurity officials in Romania said the attacks appeared relatively unsophisticated.
Italy convenes emergency cybersecurity talks
Italy’s government met intelligence chiefs and the country’s National Cyber Security Agency after around 20 stores were reportedly affected nationwide. Officials said the overall impact remained limited and indicated that outlets using outdated security systems were among those targeted.
The National Cyber Security Agency issued technical advice to retailers, focusing on the protection of connected refrigeration equipment and the wider systems used to monitor supermarket infrastructure remotely.
Giuseppe Spadaro, a director at the Coop supermarket group in Sicily, said four of the group’s 300 stores had been affected. The disruption meant food had to be thrown away and left shelves temporarily empty.
Cyberattacks affect supermarket refrigeration systems
Supermarket refrigerators and freezers are increasingly connected to the internet. Contractors can use these systems to monitor temperatures, identify faults and carry out maintenance without visiting each store.
That connectivity can also create an entry point for attackers when equipment, software or remote-access services are not adequately protected. Once refrigeration controls are disrupted, temperatures can rise quickly, threatening fresh and frozen food.
Recent research by cybersecurity company Forescout identified nearly 13,000 refrigeration control services that were openly reachable online across 99 countries. The research highlights the potential exposure of operational technology used in food retail and other essential sectors.
Countries reporting disruption
The incidents have had different effects across Europe:
- Italy: Around 20 stores were reportedly affected, prompting talks between the government, intelligence services and the National Cyber Security Agency.
- Germany: Four stores were hit.
- Sweden: Seven Coop shops were affected, with systems later restored. The retailer said the equipment used older 4G mobile connections.
- Romania: Six outlets were affected. The country’s cybersecurity director said there was no indication that a state actor was responsible.
- Belgium: The country was among the hardest hit, and federal prosecutors opened an investigation.
- France: Hundreds of supermarkets experienced a similar incident during the previous month.
- United Kingdom: Officials said vulnerable technology had been exploited in some cases and described the impact as affecting the wider food supply chain.
EU agencies coordinate response
The European Union is treating the incidents as more than isolated technical failures. EU spokesperson Thomas Regnier said European agencies were working with national authorities on a collective response and stressed the need for resilience against cyber incidents.
EU food and agriculture commissioner Christophe Hansen described the attacks as a deliberate attempt to disrupt the food supply chain. That assessment has not been matched by a confirmed attribution, however, and no person or group has claimed responsibility.
The difference between the political assessment and the technical evidence remains important. Authorities must determine whether the affected retailers were targeted by one coordinated campaign, several unrelated attacks using similar weaknesses, or criminals exploiting exposed systems opportunistically.
Why connected refrigeration is a security concern
Refrigeration controls are part of a broader category known as operational technology. These systems are designed to operate physical equipment rather than conventional office computers. A cyber incident affecting them can therefore have direct consequences for food safety, retail operations and waste.
Retailers and their technology suppliers may need to review:
- Remote access provided to contractors and maintenance companies;
- Passwords, authentication and permissions for connected equipment;
- Software updates and the replacement of unsupported devices;
- Network separation between refrigeration controls and business systems;
- Alerts for unusual temperature changes or unauthorised commands; and
- Incident plans for protecting food and restoring equipment safely.
The incidents also raise questions about supply-chain security. Supermarkets may operate equipment supplied, maintained or monitored by external contractors, meaning responsibility for cybersecurity can be spread across several organisations.
What happens next?
National investigations are continuing, with Belgian federal prosecutors among the authorities examining the attacks. EU agencies and national cybersecurity bodies are expected to compare technical information, including malware indicators, access methods and the equipment affected.
At this stage, there is no confirmed evidence identifying the attackers or proving that a government was involved. Romania’s cybersecurity chief said the activity appeared “semi-amateurish”, while officials elsewhere have warned that even relatively simple exploitation of vulnerable systems can create disruption across essential supply chains.
For consumers, the immediate impact appears to be localised disruption and food waste rather than a Europe-wide shortage. Retailers, however, face pressure to secure refrigeration technology that was often installed for operational convenience rather than designed as part of a modern cyber-defence system.
Conclusion
The supermarket freezer cyberattacks show how internet-connected equipment can turn a routine retail system into a potential food-security vulnerability. Italy’s emergency talks and the coordinated European response underline the seriousness of the issue, but the investigation has not yet established who was responsible or whether the incidents came from one campaign. The key next step is a technical assessment that can distinguish deliberate coordinated disruption from separate attacks exploiting outdated systems.