Europe’s supermarket fridge cyberattacks: Five questions every retailer should ask

Reuters reported refrigeration cyberattacks at supermarkets across Europe on 2 November, including Sweden, Belgium, Luxembourg and Ireland. Some stores removed chilled and frozen products from sale. Musgrave said 13 SuperValu stores in Ireland were affected and that monitoring systems had alerted it to the problem.

Three weeks earlier, Reuters’s report dated 12 October described attacks on hundreds of French supermarkets, with temperatures reportedly reaching 50°C, food losses and some fires. Les Mousquetaires reported around 150 affected stores. That figure covered one group; reports and retailers gave differing counts.

Reuters could not establish who was behind the November incidents or whether they were linked to France. The reports do not establish a shared perpetrator, vulnerability or entry method.

Nor do they provide evidence of vulnerabilities at Fiji supermarkets. Patternfield has not assessed any Fiji operator. For retailers comparing investments, five questions follow.

1. Who can reach the controls remotely?

A contractor may need access to diagnose a fault. The operator should know which accounts exist and whether they remain active after the work ends. Australian Signals Directorate guidance recommends restricting remote access, using strong authentication and separating control networks. Ask how those controls work in the store, including how access could be stopped while keeping refrigeration operating safely.

2. How long will the software be supported?

Danfoss told Reuters that affected French units were running outdated firmware and that it had advised customers to update supported systems and migrate legacy ones. Its statement does not establish how every compromise occurred. A purchase quote should specify when support ends and who installs updates. New equipment still needs secure configuration and maintained access controls; its age alone is no assurance of security.

3. Who answers an alarm at two in the morning?

Musgrave’s account makes response arrangements worth examining alongside the equipment. Does an overnight alert reach someone authorised to act? How long does attendance take? Independent temperature measurement may help staff detect a problem when the control system’s own readings cannot be trusted. Refrigeration and food-safety specialists should agree the response procedure and test the escalation arrangements.

4. What would one lost night cost?

Discarded stock is one part of the calculation. Emergency labour, disposal and replacement deliveries add costs; restricted trading can reduce revenue during recovery. Insurance cover needs checking against the policy’s exclusions and evidence requirements. Staff also need a documented way to isolate affected products and establish when food can safely return to sale.

5. What is the full cost of the upgrade?

In Fiji, use measured electricity consumption and current bills. EFL’s December 2025 schedule had its January authorisation suspended; a July deferral was later reported. FCCC separately announced a 5.91 c/kWh interim surcharge from 26 May. We have not established subsequent changes or current payable rates as at 3 November. Refrigerant availability and servicing costs also matter. UNEP’s bulletin records Fiji’s move against HCFC-loaded equipment; it does not establish whether existing installations can still be serviced.

The Economics of Reinvestment, Part 2 of Patternfield’s supermarket research, examines how operators could compare these uses of capital. Include support, monitoring and recovery costs over the same period as the claimed energy savings. Use actual charges and tested recovery times where available, and identify estimates where they are not.

Patternfield has a commercial interest in measurement. This analysis does not establish an investment return for any operator.