A wave of cyber attacks has disrupted refrigeration systems across dozens of supermarkets spanning Sweden to Belgium, forcing stores to discard food after hackers seized remote control of networked industrial cooling units. The incidents, which echo a similar attack on supermarkets in France just weeks earlier, have alarmed European authorities and prompted Australian cybersecurity experts to weigh in on the threat.
What Happened: Hackers Take Control of Critical Food Supply Infrastructure
The attackers were able to manipulate the temperature settings of refrigerator and freezer units with what experts described as "relative ease", exploiting the internet connectivity built into modern industrial control systems. The same remote-access feature that allows operators to monitor and adjust refrigeration units from offsite is precisely what gave the hackers a way in.
Professor Toby Murray from the School of Computing and Information Systems at the University of Melbourne said supermarket chains should treat this kind of threat as a priority concern. He noted that some of the security software used by affected stores had not been kept up to date, which may have been the point of entry for the attackers.
"It is that exact same remote control feature that then has enabled these hackers to get in there and start to control them in ways that are perhaps less desirable," Professor Murray said.
He compared the vulnerability to smart home devices: just as a homeowner can switch heating or cooling on and off remotely via the internet, so too can a malicious actor if security protections are inadequate.
No Ransom, No Claim: The Question of Who Is Behind the Cyber Attacks
No individual or group has claimed responsibility for either the current attacks or the earlier French incident, and no ransom demands have been made in either case. That absence of a financial motive is itself a significant clue, according to Sarah Logan, a senior lecturer in the Department of International Relations at the Australian National University's Coral Bell School of Asia Pacific Affairs.
"There have been no ransom requests made from either the attack this week or earlier. That might suggest it's an actor trying to demonstrate its capability," Logan said.
Logan said the two broad categories of possible perpetrators are state-sponsored groups and private criminal enterprises, but she stressed it is impossible to say with certainty which is responsible. The lack of a financial demand makes a purely commercial hacking operation unlikely, she said, particularly given that the pattern appears to be repeating.
European authorities have flagged the attacks as part of broader concerns about hybrid threats to critical infrastructure, concerns that have intensified since Russia's full-scale invasion of Ukraine in 2022. Logan noted the motivation could be something as straightforward as a hacker testing what disruption they are capable of causing, which makes predicting future attacks difficult.
"It is more than unrest; it's more than annoyance, right? It's the food supply chain. So it's a critical capability in some respects," she said.
What Australia Should Know and How to Reduce the Risk
Australian experts said the country is not uniquely vulnerable to this type of attack compared with other nations, but that does not mean the threat can be ignored. Professor Murray said internet-connected technology in supermarkets and homes alike carries inherent risks that can be managed with consistent security practices.
His recommendations include keeping all software and firmware updated, using strong and unique passwords for connected devices, and enabling two-factor authentication wherever possible.
"It is certainly worrying to think that this kind of vandalism might now become more commonplace in cyberspace," he said. "But you can protect yourself."
With no confirmed attribution for either attack and the possibility that further incidents cannot be ruled out, cybersecurity specialists say businesses operating networked industrial systems, whether in retail, logistics or food production, should treat the European incidents as a clear warning about the real-world consequences of inadequate digital security on infrastructure that underpins everyday life.
