How did supermarket fridges become a target for hackers?

Supermarket fridges and freezers became the targets of cyberattacks across Europe on Monday, with temperatures in units in some stores rising to as high as 50C.

In Ireland, 13 SuperValu stores were affected, forcing chilled and frozen food to be removed from sale. Musgrave, the company behind SuperValu, said the incident was resolved that evening.

The disruption came just weeks after hundreds of French supermarkets were hit by similar attacks, while cold storage rooms at some French blood banks were also targeted earlier this week.

But how did equipment used to keep food cold become a target for hackers — and what do we know about how they got in?

---

What systems were affected?

RTÉ Clarity understands that some of the affected SuperValu stores used refrigeration controls supplied by Danish company Danfoss.

These controls allow engineers to check temperatures and change settings without visiting the shop.

Danfoss controllers were also among the systems targeted by last month's cyberattack in France which caused refrigerators to overheat at around 700 supermarkets.

Researchers at Claroty, a cybersecurity company specialising in protecting connected industrial equipment, identified several security weaknesses in Danfoss refrigeration controllers prior to that attack.

They reported their findings to Danfoss, which released software updates to address them.

Claroty urged users of the affected controllers to install the updates and ensure their management interfaces were not directly accessible over the public internet.

Marta Rybczynska, a cybersecurity specialist who works on securing software built into connected equipment, said outdated software and refrigeration controls exposed to the internet may have enabled the latest attacks which affected Irish supermarkets.

The Irish National Cyber Security Centre said on Monday that the latest cyber incident may be related to a "known vulnerability".

Ms Rybczynska said attackers often exploit known software flaws, including shortly after updates to fix them become available, while some users have yet to install them.

How can refrigeration controls be hacked?

High-profile cyberattacks in recent years have tended to target IT (information technology) systems.

However, these latest attacks on refrigeration controller systems are examples of the targeting of OT (operational technology).

Operational technology refers to systems used by companies that monitor and control infrastructure, often using automation.

These systems generally involve machines and interact with the physical world.

While distinct to IT systems, OT systems are often connected to internet networks which makes them susceptible to cyberattacks.

Ms Rybczynska said third-party contractors maintained the refrigeration controls at the affected French supermarkets. In her assessment, some may not have installed software updates addressing security weaknesses which had recently been discovered.

She contrasted this with frozen-food retailer Picard, which she said maintained its systems internally and was not affected by October's attacks.

Ms Rybczynska said that in some cases shop owners did not know that their fridges were connected to the internet.

"In addition to that, at least some models have easy to guess passwords, like the current date.

"Those are typically old designs, [and are] sometimes no longer supported by their manufacturers."

Danfoss said it has been in close contact with customers over the past three weeks to help them manage the situation and recommended that systems should not be directly accessible via the internet.

RTÉ asked Danfoss whether its systems were targeted in the attack which affected refrigeration systems in Ireland this week.

At the time of publication, Danfoss has not provided a response.

What do we know about the security weaknesses?

France’s cybersecurity agency, CERT-FR, similarly advised removing direct internet access to the affected systems and only allowing remote access through a secure VPN or protected network.

"In general, exposing a management interface to the internet is contrary to best practices," the agency said.

Ireland’s National Cyber Security Centre said internet-facing management interfaces should be "appropriately secured, maintained, and updated in line with established cybersecurity best practices".

Ms Rybczynska said some refrigeration systems need internet access for functions such as sending temperature alerts overnight, but warned against directly connecting outdated equipment to the public internet.

"Outdated devices should never been directly connected online," Ms Rybczynska said.

Danfoss has previously said the equipment affected in France included older systems that no longer receive security updates, as well as newer models running outdated software.

The specific controller models and software versions involved in Ireland have not been publicly confirmed.

"A big open question in this case is why those devices were still apparently working well, but declared outdated by their manufacturers," Ms Rybczynska said.

"Maybe they should have been receiving security updates for longer," she added.

The EU's Cyber Resilience Act (CRA) is trying to solve some of those issues.

The act will mean that from next year manufacturers will be required to tell customers how long their products will continue to receive security updates into the future.

Who is responsible?

Pro-Russian hacking groups NoName057(16) and Z-Pentest Alliance claimed to have jointly hacked Danfoss technology in Telegram posts reported by international media, including the BBC and Italy's public broadcaster Rai.

The groups' involvement in the supermarket attacks has not been independently established, nor is it known whether Monday’s incidents and October’s attacks were carried out by the same perpetrators.

Denmark's military intelligence agency previously attributed a destructive attack on a Danish waterworks in 2024 to Z-Pentest. It also said NoName057(16) carried out attacks overwhelming Danish websites ahead of local elections in 2025.

Both groups have also been named in US Justice Department action over alleged cyberattacks on critical infrastructure.

Ms Rybczynska said she saw no clear financial gain from the supermarket attacks and suggested the attackers may have been motivated simply to cause "unrest".

Danfoss refrigeration controllers have been targeted before.

According to the company, 16 supermarkets in Russia using its AK-SM 800 controllers were targeted by cyberattacks in early 2022. It said 40 stores in Israel using the same model were also hacked that year.

Danfoss said all 40 affected Israeli stores "lacked proper firewall or VPN protection."

Could other connected equipment be targeted?

The NCSC said that these latest incidents "highlight the importance of maintaining strong cybersecurity measures across operational technology environments".

Ms Rybczynska said similar security issues would continue to affect other connected equipment, including solar panels and smart home devices, and that Europe was not as prepared as it should be for attacks of this nature.

"There have been years of deploying connected devices without taking cybersecurity seriously."

She said internet access is often an add-on to operational technology systems, as opposed to being part of the original design.

"When you are adding this internet access, you need to rethink the whole design to see if it has enough protection. And that's not always happening."