Massive Supermarket Refrigeration Hack May Have Cost Hundreds of Millions of Euros

A large-scale cyberattack targeting supermarket refrigeration systems may have cost tens or even hundreds of millions of euros. Stores in Spain, Portugal, Poland, Germany, and Belgium were reportedly affected.

The incident was enabled by several basic cybersecurity failures, including outdated controller firmware, internet-exposed devices, and remote-access systems without adequate restrictions. Some affected stores may have placed their refrigeration controllers behind a VPN but failed to create an allowlist of approved IP addresses for logins.

Outdated refrigeration controllers exposed supermarkets

Security protections such as VPNs, IP allowlists, updated firmware, and changed default passwords are standard recommendations for industrial control systems. However, they are not always implemented, particularly when third-party equipment is connected to a company’s network.

“Two things would have changed the outcome,” researchers at Penetration Testing Partners said Wednesday. The researchers said the attack could have been prevented by removing controllers from the public internet, placing remote access behind VPNs and IP allowlists, changing known default credentials, and installing the latest software updates.

They also recommended deploying third-party equipment through a controlled, owned, and documented network connection rather than leaving it connected through a contractor’s own systems.

Security researchers had warned about the risks

Researchers at security firm Claroty previously warned about the dangers of ignoring these safeguards in an October report. The U.S. Cybersecurity and Infrastructure Security Agency issued a similar warning in February.

In an email, Copeland acknowledged that the vulnerability was “identified in a discontinued, end-of-life generation of controllers.” The company said it is working with customers to help prevent similar incidents in the future. A Danfoss representative did not immediately respond to questions. According to CNN, Danfoss also referred to a discontinued model.

Attack motive remains unknown

The people responsible for the attack have not publicly claimed responsibility. Their silence leaves the motive unclear. The incident may have been large-scale vandalism, but it could also have involved nation-states or other international actors attempting to create disruption across Europe.

Why companies delay cybersecurity upgrades

The attack highlights the ongoing tension between corporate finance and security departments. Companies may hesitate to spend heavily on replacing old equipment when the benefits are not immediately visible.

However, the incident demonstrates the potential cost of delaying those investments. Executives at the affected supermarket chains are likely to face a harsh lesson about the risks of outdated industrial equipment and poorly secured remote access. Whether the warning will prompt other companies to improve their defenses remains unclear.