Britain's National Cyber Security Centre, or NCSC, advised organizations in August to identify their OT assets and external connections and ensure control devices are not directly accessible from the public internet. It also recommended replacing default credentials and using multi-factor authentication where supported.

LONDON, Nov. 3 (Xinhua) -- Multiple cyberattacks on supermarket refrigeration systems across Europe recently have forced retailers to withdraw food from sale, highlighting the impact on daily life of weaknesses in connected equipment.

The incidents have raised questions about why everyday equipment is connected to the internet, what makes it vulnerable and how businesses and consumers can reduce the risks.

WHY ARE SUPERMARKET FRIDGES A TARGET?

Refrigeration systems in 13 SuperValu stores in Ireland were affected by a cyber incident, while one Swedish store said its fridge and freezer temperatures had been set to 50 degrees Celsius, Sky News reported on Monday. Similar incidents were reported elsewhere in Europe.

The disruptions followed attacks on hundreds of French supermarkets in October, which prompted an investigation by the Paris prosecutor's office.

Richard Horne, head of Britain's National Cyber Security Centre, told BBC Radio 4 on Tuesday that it was too early to say who was behind the latest attacks.

Commercial refrigeration systems use controllers that allow operators to monitor equipment, adjust temperatures and carry out maintenance remotely. A single management platform can coordinate numerous units, making it easier to manage a store's refrigeration.

Research published in August by cybersecurity company Claroty described a refrigeration management system that allows operators to monitor multiple units, adjust temperature settings and review alarms through a single web interface. It also enables remote maintenance, reducing the need for engineers to visit each site.

The same functions can become a means of disruption if an attacker gains unauthorized access. Sky News quoted Stephan Moelans, chief executive of Belgian refrigeration company Sabcobel, as saying that the latest incident involved switching the units' evaporators to defrost mode.

Food retailers are particularly sensitive to interruptions because their stock is perishable.

Researchers at cybersecurity company Forescout's Vedere Labs said in an analysis published in October that attackers could misuse legitimate refrigeration controls to cause physical disruption and financial losses, even without deploying destructive malware.

WHAT MAKES CONNECTED DEVICES VULNERABLE?

The Internet of Things, or IoT, brings network connectivity to physical devices, enabling them to collect and exchange information. A University College London policy briefing describes how such connectivity extends to everyday products, including cameras, televisions and household appliances.

Commercial refrigeration controls also involve operational technology, or OT. Britain's Department for Science, Innovation and Technology describes OT as programmable hardware and software used to monitor, control and manage industrial operations. Its security matters because unauthorized changes can affect what equipment actually does.

A study published by the department in December 2025 identified weaknesses including old equipment, inadequate asset management and risks involving third-party suppliers.

Based on interviews with 30 people and a review of existing research and reports, the study found that some longstanding OT systems were never designed for an internet-connected environment. Connecting them to corporate networks for monitoring and management can introduce routes for attackers.

Exposing management pages to the public internet and failing to install security updates can leave connected devices vulnerable to attack.

Claroty's researchers found that some refrigeration systems had management pages directly accessible over the internet. They also identified security flaws in certain refrigeration controllers. The manufacturer has released a software update to fix those flaws, but operators need to install it on affected devices. Whether those flaws were exploited in the latest attacks remains unconfirmed.

The consequences vary by device and access gained. The UCL briefing notes that vulnerable consumer devices can expose personal information or be used in distributed denial-of-service attacks, which overwhelm websites or online services.

In refrigeration, tampering can disrupt the cold chain that keeps perishable food at controlled temperatures during storage and transport.

Britain's 2024 Food Security Report warned that cyberattacks could interfere with purchasing, transporting and selling goods, including through connected sectors such as energy and water.

HOW CAN THE RISKS BE REDUCED?

Businesses first need to know which devices they operate, how they connect and who can access them.

Britain's National Cyber Security Centre, or NCSC, advised organizations in August to identify their OT assets and external connections and ensure control devices are not directly accessible from the public internet. It also recommended replacing default credentials and using multi-factor authentication where supported.

The NCSC guidance recommends separating control systems from business networks to limit an intruder's ability to move between them. Monitoring unusual connections and configuration changes can help identify problems, while tested backups and recovery plans support the restoration of operations.

France's CERT-FR cybersecurity response team issued similar advice after the October attacks, recommending protected remote connections, configuration checks and firmware updates. It warned that a factory reset alone would not protect unsupported equipment from another compromise if it remained exposed to the internet.

Manufacturers also have a role in making flaws easier to report and providing security support.

A report published in January by the IoT Security Foundation found that only 199 of the 491 consumer IoT manufacturers examined in its 2025 study provided a way for security researchers to report flaws. The study checked whether manufacturers offered such reporting channels, and it did not test whether their products were secure.

According to British government guidance, the country's consumer connected-product security regime, effective since April 2024, requires passwords to be unique to each product or set by the user. Manufacturers must also publish vulnerability-reporting information and the minimum period for which security updates will be provided.

These are baseline requirements for products within the consumer regime's scope. They should not be assumed to cover every commercial refrigeration controller.

For households, the NCSC recommends installing updates promptly, enabling two-step verification where available and turning off remote access when it is unnecessary. Buyers should also check how long a manufacturer will support a device.

The guidance points to a continuing responsibility: connected equipment needs security maintenance for as long as it remains in use.