Israel urges retailers to check refrigeration security after European cyberattacks

The Israel National Cyber Directorate issued a warning on Monday, November 2, to retail chains, food companies and logistics centers across Israel following a wave of cyberattacks on refrigeration systems in Europe. It urged businesses to examine the security of systems used to control refrigerators and freezers, particularly those accessible remotely.

Hackers took control of refrigeration settings at dozens of European stores and increased temperatures inside refrigerators and freezers. The attacks spoiled large quantities of food and caused significant financial losses. In some cases, the incidents also resulted in damaged equipment and fires.

The affected businesses included supermarket groups Ahold Delhaize and Colruyt in Belgium and Luxembourg, along with Swedish grocery retailers ICA and Coop. At least one IKEA outlet was also affected. The incidents prompted the Israeli directorate to ask businesses across the country to inspect their own refrigeration equipment and associated control systems.

The directorate placed particular emphasis on systems that technicians and service providers can access remotely. Retail chains were asked to submit the findings of their inspections to the agency and explain which protective measures they had put in place. Its warning covered both checks of existing systems and steps to strengthen their security.

Among the recommended safeguards were removing direct internet exposure from refrigeration and control systems, replacing default passwords and updating outdated systems. The directorate also advised businesses to protect remote access with multi-factor authentication and enable independent alerts that can identify unusual changes in temperature.

At an ICA franchise store in Stockholm, sales manager Engla Ingwall described the damage during a Reuters visit on Monday. She said the attack took place at 2 a.m., but staff did not discover it until hours later. “Everything is destroyed,” Ingwall told Reuters, describing the condition of the store’s stock after the refrigeration failure.

Ingwall said all of the store’s freezers had reached 50 degrees Celsius following the cyberattack. Her account described both the extent of the temperature increase and the delay between the attack and its discovery.

A spokesperson for privately held ICA said the company was aware that a limited number of stores had experienced an incident overnight. The spokesperson said the incident had affected those stores’ refrigeration and freezer systems.