Unidentified Actors Remotely Altered Grocery Cooling Controls in Europe

Key points

• Unidentified attackers remotely modified cooling and freezing settings at European grocery chains.
• More than one retailer and multiple countries were affected, with store operations disrupted.
• No CVE was cited; the incident points to unauthorized control access rather than a known software bug.
• IT and facilities teams should audit remote access to refrigeration and building controls.

Unidentified cyber actors remotely changed configuration values on cooling and freezing equipment used by grocery retailers in Europe. The activity touched more than one chain and spanned a number of nations, according to the available facts. Store operations were disrupted, and controls governing equipment temperature were manipulated.

The organizations affected are supermarket operators that depend on networked refrigeration and freezer systems. Because those systems support daily store activity, unauthorized adjustments can interrupt normal operations and raise concerns about product integrity. The facts do not indicate whether any merchandise was lost or whether customer data was involved.

No specific CVE identifier was referenced, so the event does not appear tied to a publicly documented software flaw. That makes access control and remote management paths the most likely areas to examine. The attackers' identity and motive remain unknown, and the facts do not specify which interfaces or accounts were used.

Refrigeration equipment often sits at the boundary between IT and operational technology, where remote maintenance accounts and exposed control interfaces can create risk. Retailers should determine how the settings were reached, whether vendor or support credentials were involved, and whether similar controls exist at other sites. Watching for unexpected setpoint changes and reviewing remote-access logs will be important as the response develops.

What to do now

1. Immediately inventory all remote-access paths into refrigeration, freezer, and building-management systems, including vendor accounts and support tunnels.
2. Enforce multi-factor authentication and unique credentials for every account that can change cooling setpoints or equipment configuration.
3. Remove direct internet exposure from refrigeration controllers and place them behind restricted, monitored access with allowlisted source addresses.
4. Enable and centralize logging for setpoint changes, configuration edits, and remote sessions; alert on out-of-hours or unexpected modifications.
5. Segment refrigeration and building-control networks from general corporate IT and limit lateral movement between store systems.
6. Verify manual override and fallback procedures so store staff can protect temperature-sensitive products if remote controls are unavailable.
7. Contact refrigeration vendors and managed-service providers to confirm whether their remote tools were used and to rotate any shared credentials.

Original source

BleepingComputer