UK supermarkets warned after hackers heat fridges to 50C in stores across Europe
Hackers have taken over fridges and freezers in hundreds of supermarkets in France, Belgium, Ireland and Sweden. There is no evidence that any British store has been hit, but a cyber security firm says more than 800 UK supermarket fridges could be reached online.
Supermarkets in the UK have been warned about the risk of cyber attacks on their refrigeration systems after hackers took control of fridges and freezers in hundreds of stores across Europe and pushed temperatures up to 50C.
The attacks began in France in October, when hackers got into the temperature controls at hundreds of supermarkets overnight. Food was spoiled, and some stores reportedly had fires.
Carrefour said 80 of its stores were affected. The owner of Intermarché said fridges at around 150 of its stores were heated for about six hours.
Attacks spread beyond France
Since then, attacks have been reported on 40 Delhaize supermarkets in Belgium and Luxembourg, 13 SuperValu stores in Ireland, and ICA and Coop shops in Sweden.
No one has claimed responsibility for any of the attacks.
The hackers are understood to be getting in through older fridge control systems that no longer receive security updates and have been left reachable on the internet. CERT-FR, France's national computer emergency response team, has told supermarkets to take these systems offline.
What it means for UK shoppers
There is no evidence that any British supermarket has been targeted so far. However, the UK cyber security firm UK Cyber Defence has warned that the control systems for more than 800 UK supermarket fridges can be reached by "anyone on the internet who knows where to look".
It is not known which supermarket chains or stores those systems belong to, or whether any are in West London. None of the major UK grocers has said publicly that its stores are at risk.
Refrigeration controls of this kind manage the temperatures of chilled and frozen food. If they are changed without anyone noticing, food could be kept at unsafe temperatures before staff realise. In the attacks in Europe, stores had to throw away stock, and some had to deal with fires.
Shoppers who think chilled or frozen food they bought has not been kept cold properly should not eat it, and should take it back to the store. Food safety concerns can also be reported to the local council's environmental health team.
What happens next
Cyber security specialists say the main step for retailers is the one CERT-FR has recommended: disconnect older, unsupported control systems from the open internet, or replace them with systems that still receive security updates.
In the UK, the National Cyber Security Centre gives guidance to businesses on protecting connected equipment. Businesses that are hit by a cyber attack can report it to the police through the national fraud and cyber crime reporting service.