(Brussels, Belgium) – European authorities are coordinating a response after cyberattacks on commercial refrigeration systems spread to Germany, Romania and the United Kingdom, widening a disruption that has forced grocery businesses to discard spoiled food.

AFP reported November 3 that officials and companies had identified four affected supermarket outlets in Germany and six in Romania. British meat suppliers also reported refrigeration problems. The expanded geographic reach and coordinated government response are new developments beyond the initial failures reported November 2.

European Commission spokesperson Thomas Regnier said EU agencies were working with national authorities on a collective response. He declined to identify possible perpetrators. Italy held talks involving ministers, intelligence chiefs and its cybersecurity agency, although its government described the domestic impact as limited.

Belgian federal prosecutors have opened an investigation. Belgium was among the hardest-hit countries, with refrigeration failures reported across dozens of stores, according to AFP. In Sweden, the Coop chain said seven affected shops had returned to normal operations.

The incidents involve equipment that regulates the temperature of refrigerated and frozen-food storage, rather than simply the theft of customer information. Aju Press reported November 4 that retailers were disconnecting equipment from the internet and updating systems after the latest disruptions.

Internet connections let technicians monitor equipment and troubleshoot remotely, but exposed controls can also allow intruders to change operating settings. The Associated Press reported that French investigators had identified compromised controllers from several product ranges during the earlier wave of attacks in October.

Danfoss told AP that most affected systems were older products no longer receiving software or security updates. Copeland identified a vulnerability in discontinued controllers. British cybersecurity officials said known weaknesses and default passwords had contributed to the French incidents.

Responsibility remains unresolved. Romania’s cybersecurity director, Dan Cimpean, told AFP that he did not suspect a state actor; that assessment does not establish who carried out attacks elsewhere. Authorities have not established a motive.

The distinction matters for Canadian readers following threats to essential supply chains: these incidents demonstrate physical disruption through connected equipment, but the consulted reporting does not establish that Canadian stores were affected.

Accompanying image: editorial illustration.

Sources