Supermarket Freezer Control Systems Compromised Across Europe, Disrupting Supply Chains

Qué ocurrió

Over the past six months, attackers breached the programmable logic controllers (PLCs) that manage refrigeration units in major European supermarket chains. By leveraging default credentials and outdated firmware on off‑the‑shelf IoT freezer controllers, they overrode temperature set‑points, causing freezers to warm up and resulting in thousands of perishable goods spoiling. The incidents were first reported by a German cyber‑security agency and later confirmed by retailers in France, Spain, and the Netherlands. No ransom was demanded; the primary impact was operational—loss of inventory, temporary store closures, and a cascade of supply‑chain delays as distributors scrambled to replace spoiled stock. Retailers are now conducting forensic investigations and working with device manufacturers to remediate the vulnerable firmware.

Por qué es importante para la confianza y el cumplimiento

• The attacks expose a gap in OT access control and third‑party device oversight, underscoring the need for continuous monitoring of vendor‑supplied hardware to maintain audit‑ready evidence of secure configurations.
• Demonstrates the importance of continuous vendor risk monitoring for OT components.
• Provides evidence for control mapping to access‑control objectives across multiple frameworks.

Who is affected

Recommended actions

1. Inventory all IoT/OT refrigeration assets and map them to your control framework.
2. Enforce strong authentication, disable default credentials, and apply firmware updates promptly.
3. Deploy continuous monitoring and logging of PLC command traffic to detect anomalous temperature changes.