Recent cyber-attacks targeting supermarket refrigeration systems across Europe, including Ireland, demonstrate how vulnerabilities in connected technology can have serious consequences for operations, product safety and supply chain resilience.
Supermarkets across Europe have experienced disruption after attackers reportedly gained remote access to refrigeration systems and manipulated temperature controls, in some cases raising temperatures to 50°C.
This week in Ireland, 13 SuperValu stores were affected, with chilled and frozen products removed from sale as a precaution. Similar incidents have been reported in Sweden, Belgium and other European countries. These follow attacks on supermarket refrigeration systems in France in October.
These incidents highlight an increasingly important reality: cyberattacks are no longer just a threat to data. They can directly disrupt physical operations, compromise products safety and affect business continuity.
The hidden vulnerabilities in connected systems
Many supermarket refrigeration systems are monitored and managed remotely, often by third-party refrigeration contractors. According to CERT-FR and the manufacturers and installers involved, the targeted controllers had management interfaces that could be reached from the internet. Many were older models that no longer receive security updates, and some still used default passwords.
The attackers did not need malware. They used the systems' own settings, such as defrost cycles and temperature setpoints. The same weaknesses apply well beyond refrigeration: building management systems, production equipment and other industrial controls are often connected for convenience, and exposed interfaces and weak remote access give attackers an easy way in.
Nothing about these attacks appears to have been advanced, and that is the real warning. Exposed controllers like these can be found with freely available scanning tools, so being a small or unremarkable business offers no protection.
The harder problem is ownership: refrigeration and building systems often sit between facilities teams, IT and outside contractors, so nobody treats them as a security asset until something goes wrong. Attribution is still open, but organisations don’t need to know who did this to act. Find out which of your operational systems are connected and who can reach them, including your suppliers, and take anything that doesn’t need to be on the internet off it.
What does this mean for businesses and their supply chains?
Although supermarkets have been the immediate targets, the implications extend across food manufacturing, warehousing, logistics, healthcare, pharmaceuticals and other industries dependent on connected operational systems.
For organisations employing digital systems to manage critical production controls, including continuous temperature management, unexpected system failures could result in significant financial losses, compromised product safety, regulatory concerns and disruption across the wider supply chain.
Supply chain resilience depends on more than the physical movement of goods. There is a real disconnect between a company’s internal risk management teams and these recent attacks are a clear demonstration of the convergence of risk; a breach in IT systems affects not only IT infrastructure and data, but most importantly for the food and beverage sector consumer safety. As businesses become increasingly reliant on connected technology, cybersecurity is critical to protecting product integrity and maintaining consumer trust.
How can organisations protect themselves?
In line with CERT-FR's advice and wider guidance on internet-exposed OT, organisations should take these steps:
- Find their exposure: Build an inventory of connected OT and IoT devices, including legacy equipment and anything installed or managed by third parties. Check which of them can be reached from the internet.
- Remove direct internet access: Take controller and HMI management interfaces off the public internet. Allow remote access only through a secure VPN or protected network, with multi-factor authentication.
- Replace or isolate end-of-life equipment: Unsupported devices can't be patched, and if they are left exposed they are likely to be compromised again.
- Fix the basics: Change default passwords and apply firmware updates. Review settings such as setpoints, defrost schedules and alarm thresholds.
- Control supplier access: Agree in contracts how maintenance providers connect, who can change settings, and how that access is logged and reviewed.
- Set up independent alerts: Make sure temperature alarms reach someone around the clock, and that unexpected configuration changes are spotted.
- Plan for disruption: Make sure incident response and business continuity plans cover attacks on physical operations, including withdrawing products, food-safety checks and restocking.
As IT, OT and supply chains become more closely linked, cyber resilience is a board-level issue, not just an IT responsibility. Being able to keep operating safely during a cyber incident is what protects products, customers and public trust.
The European refrigeration incidents are a timely reminder that cyber resilience is a business-critical issue, not simply an IT responsibility. For organisations managing complex supply chains and connected operational systems, understanding vulnerabilities, strengthening supplier controls and regularly testing business continuity plans should be a board-level priority. Ultimately, the ability to maintain safe operations during a cyber incident is essential to protecting products, customers and public trust.
Concerned about your organisation's cyber exposure?
If these incidents have raised concerns about the security of your connected systems, operational technology or wider supply chain, speak to the LRQA Cyber team.
Our specialists can help you understand your exposure, identify potential vulnerabilities and take practical steps to strengthen your organisation's cyber resilience.
Contact LRQA Cyber to discuss your needs