Swedish supermarket group ICA has reported disruption to refrigeration and freezer systems at a number of its stores. The incident has left some locations unable to sell chilled or frozen products while affected systems are investigated and restored.
At one ICA store in Böda, staff reportedly arrived to find refrigeration equipment malfunctioning, with freezers operating at temperatures completely unsuitable for storing food. The store remained open, but without fresh or frozen products available for sale.
Other retailers appear to have experienced similar problems.
Coop stores in Sweden have reported refrigeration issues, while a number of SuperValu stores in Ireland have also been affected, resulting in fresh and frozen food reportedly having to be discarded.
These incidents follow similar attacks against supermarkets in France during October, where refrigeration systems were reportedly manipulated remotely. In some cases, temperatures were increased sufficiently to cause large quantities of food to be written off.
The weak point may not be where you expect
One of the particularly interesting aspects of these incidents is that the attackers were not necessarily targeting the traditional IT infrastructure that businesses normally associate with cybersecurity.
Instead, attention has focused on refrigeration controllers and other connected operational technology.
Some of the affected French stores were reportedly operating older firmware on Danfoss refrigeration controllers. French cybersecurity authorities subsequently issued warnings relating to compromises involving certain Danfoss AK-SM and AK-SC controllers.
It has not yet been established whether the more recent incidents used the same vulnerabilities or attack methods, and different retailers may operate completely different systems.
However, the wider lesson is important.
Almost anything connected to a network can become a cybersecurity risk
Modern businesses have an increasing number of devices connected to their networks.
These can include:
CCTV cameras and NVRs Door access systems Building management systems Heating and air-conditioning controllers Refrigeration equipment Alarm systems Printers and multifunction devices VoIP telephone systems Digital signage Smart TVs and displays Environmental monitoring equipment Industrial and manufacturing systems Internet of Things (IoT) devices
These systems are often installed and then largely forgotten.
Unlike Windows computers and servers, they may not receive regular security updates. Default passwords may remain unchanged, remote management interfaces can sometimes be exposed to the internet, and older equipment may continue operating for many years after its software or firmware has become outdated.
That creates an attractive opportunity for cybercriminals.
Cybersecurity is about more than protecting your data
Businesses understandably concentrate their cybersecurity efforts on protecting email, Microsoft 365 accounts, customer information, servers and business-critical documents.
Those remain extremely important.
But these latest incidents demonstrate that a cyberattack can also have a physical and operational impact.
Imagine a similar attack affecting your CCTV system, access control, heating, manufacturing equipment or another critical system.
The result might not simply be lost data.
It could mean:
operations being interrupted; premises becoming inaccessible; equipment becoming unavailable; stock or materials being damaged; customers being unable to receive services; significant recovery costs; and potentially several days of business disruption.
For supermarkets, interfering with refrigeration can quickly result in thousands of pounds' worth of stock becoming unusable. For another organisation, compromising a different connected device could have an equally serious consequence.
What should businesses be doing?
At Q6IT Services, we believe organisations should consider connected devices as part of their wider cybersecurity strategy rather than treating them as completely separate systems.
Businesses should know what is connected to their network, who manages it and whether it is still receiving security updates.
That means keeping firmware up to date, changing default credentials, restricting unnecessary remote access and separating IoT or operational equipment from the main corporate network using appropriate VLANs and firewall rules.
Where remote access is genuinely required, this should ideally be provided through secure mechanisms such as a VPN rather than exposing device management interfaces directly to the internet.
Regular vulnerability assessments and network reviews can also help identify equipment that may have been installed years ago and subsequently forgotten.
Could you identify every device connected to your business network?
That is a question worth asking.
Cybersecurity is no longer simply about installing antivirus software on PCs.
As businesses become increasingly connected, protecting the network means understanding every device that relies on it, from laptops and Microsoft 365 accounts through to cameras, telephones, access control and building management equipment.
The supermarket incidents provide a useful reminder that even something as ordinary as a refrigerator can become a cybersecurity problem when it is connected to a network.
For businesses, the question is increasingly not just "Are our computers secure?"
It is:
"Do we actually know what is connected to our network, and is it secure?"
If you're unsure, Q6IT Services can help review your business network, identify connected devices and assess areas where outdated equipment, insecure configurations or unnecessary internet exposure could leave your organisation vulnerable.