Which supermarkets were affected and what does it mean? 

The attack hit fridges in Belgian branches of Carrefour, Intermarché and Ikea, Coop and ICA in Sweden, Delhaize in Luxembourg, Kesko in Finland, SuperValu in Ireland and shops in Estonia.

It appeared to be a reprise of attacks three weeks ago when French retailers had to ditch huge amounts of food when their fridges suddenly overheated as a result of anonymous hackers seizing control of their internet-exposed appliance management software.

Something similar may have happened in the US in early August when a series of mysterious fridge malfunctions hit commissaries at least six military bases. The Pentagon is investigating a suspected hack.

This is feared to signal a new front in cyber-attack and hacking tactics. Fridges are not unique in having their controls exposed to hackers. Many ovens, washing machines, dishwashers and central heating systems are linked to the internet to allow remote access and automated control. 

Who is doing it?

No politically motivated “hacktivist” group has claimed responsibility and neither has a ransomware gang exploited the vulnerability to demand the supermarkets pay – which in any event would be difficult because the damage is already done when their fridges overheat. 

“The two most plausible attribution scenarios for me are some kind of state-based signalling and demonstration of capability or some kind of lone-wolf hacker that is conducting these attacks for their own personal reasons,” said Rafe Pilling, the senior director for threat intelligence at the cybersecurity company Sophos. 

The state-linked actor theory seems most likely, in part because of the obvious psychological impact on large populations of seeing food stripped from shelves. North Korea is believed to have been behind last week’s Binance cryptocurrency heist, but in this case hackers linked to Russia and China are also likely to be in the frame.

Western intelligence chiefs say Moscow is waging a campaign of sabotage in Europe that takes many different forms and is likely to intensify in the coming months.

Discerning the culprit is made harder by the relative simplicity of the hack. No malware was needed, which means there is no trace of a weapon at the scene of the crime. Pilling compared it to “wearing rubber gloves and messing with the switches”.

How is it possible?

The software that manages commercial fridges is connected to the internet, which means lines of code can be left vulnerable to hackers. Unlike desktop or mobile devices, on which users and IT managers are often alerted to the need to install updates that contain patches to repair constantly emerging vulnerabilities, the software in items such as fridges can be left for long periods without updates.  

Nick Jackson, the director of cyber-operations at the cybersecurity company Bitdefender, said one reason companies might move slowly to install patches is they can take time to run, which leaves periods when machinery needs to be offline – an obvious problem for food retailers. But he said a simpler explanation could be that the people running the fridges are not aware of the problem, “don’t think about that and it’s not top of their agenda”.

In Monday’s wave of incidents, Coop in Sweden said some of its fridges were linked to a 4G mobile network that made them more exposed. ICA said its system was provided by Danfoss, the Danish company that had problems in France. 

What can shops do to defend themselves?

The simple answer is to patch their software systems. According to the Belgian refrigerator group Sabcobel, the impact of Monday’s hack could have been far worse if they had not started patching fridges after the 12 October attack in France.

In the UK, which has not yet been affected, retailers are “currently working with the National Cyber Security Centre(NSCC) to ensure their fridges and freezers are secure as possible against potential attacks” said Graham Wynn, the assistant director of regulatory affairs at the British Retail Consortium.

Why have British supermarkets not been hit yet?

Internet-exposed refrigeration systems are most popular in countries including France, Italy, Greece and Belgium, according to the cybersecurity company Forescout.

Daniel dos Santos, its vice president of research, said: “When we checked the data for these exposed systems online of supermarkets, the UK is not in the top 10.” He said the risk was not negligible, but “I wouldn’t say it’s super-high right now for the UK specifically”.

A spokesperson for the NCSC said it was “working with its international partners and industry to fully understand details of an incident”.