Three Warning Signs Behind the Attack

• Hackers remotely manipulated supermarket refrigeration systems across Europe, in some cases driving temperatures to 122 degrees Fahrenheit.
• Security researchers previously found thousands of internet-exposed refrigeration controllers and serious vulnerabilities capable of giving attackers remote access.
• If the same attack hits an American supermarket or home, insurance coverage may depend on a few words buried deep inside the policy.

Supermarket employees across Europe walked into stores Monday to find an unusual kind of cyberattack underway. Computers were still running. Customers' credit cards had not necessarily been stolen. The target was something far more physical — the refrigerators.

Stores in Sweden, Belgium, Luxembourg, Ireland and Estonia reported refrigeration problems in what authorities and retailers described as apparent cyberattacks. At one ICA supermarket in Sjöbo, Sweden, the store said hackers had set refrigerators and freezers to 50 degrees Celsius — 122 degrees Fahrenheit. Food had to be discarded. Carrefour said 15 stores in Belgium were affected, while Ireland's SuperValu reported problems at 13 locations.

This was not the first warning.

Hundreds of French supermarkets were hit in October by attacks in which internet-connected refrigeration controllers were remotely manipulated. Attackers could alter temperature settings, interfere with alarms or keep refrigeration equipment in defrost mode long enough to destroy perishable inventory. French authorities opened an investigation after the attacks caused food losses and, in some locations, fires.

What makes the story more troubling is that researchers were warning about this technology before the attacks.

Cybersecurity researchers with Claroty's Team82 examined Danfoss AK-SM 800A refrigeration controllers and discovered vulnerabilities affecting their web-management systems. One flaw could bypass normal authentication. Another could allow remote code execution. Researchers also found 2,765 publicly accessible Danfoss devices during their investigation. Danfoss subsequently issued firmware fixes. There is no public evidence establishing that those specific vulnerabilities were used in the European attacks, and Claroty has cautioned that the attackers' precise entry method remains unknown.

That distinction matters. But so does the larger warning.

Businesses have spent years securing laptops, servers and payment systems while equipment quietly became computers too. Refrigerators, HVAC systems, security cameras, door locks, thermostats and industrial controllers can now sit on networks for years — sometimes long after someone stopped thinking about their firmware.

Danfoss currently recommends updated software for its AK-SM 800A series that includes additional cybersecurity protections and account-management improvements.

The American insurance question gets complicated quickly.

If hackers remotely push a supermarket freezer into defrost mode and $100,000 worth of meat spoils, a business cannot simply assume its property policy will pay.

The National Association of Insurance Commissioners warns that most commercial property and general liability policies do not cover cyber risks and that cyber policies themselves are highly customized.

Standard commercial property forms can also contain a specific Cyber Incident Exclusion covering losses caused by unauthorized computer access, malicious code or denial-of-service attacks. Some forms preserve coverage for resulting fire or explosion, but that does not necessarily restore coverage for the original cyber-caused loss.

Here is the insurance trap supermarket operators should notice: even specialized spoilage coverage can be subject to the policy's cyber-incident exclusion. In other words, a policy may cover spoiled food when a refrigeration system mechanically fails, yet produce an entirely different answer when a hacker deliberately causes essentially the same temperature change.

American homeowners face a similar question.

Homeowners insurance sometimes pays for refrigerated food lost because of a covered power failure, often subject to limits and policy-specific conditions. But a hacker remotely disabling a smart refrigerator is not the same thing as lightning knocking out electricity. Standard homeowners coverage was not designed around that scenario, while optional personal-cyber endorsements vary considerably in what they actually reimburse.

That makes the refrigerator attacks more than a European grocery story.

They expose a problem sitting quietly inside modern homes and businesses. We routinely update our phones because the device reminds us. Nobody expects the freezer aisle to ask for a security patch.

Attackers increasingly know the difference.

Keep Reading Beyond the Headlines

If you value reporting that looks past the initial headline and examines the legal, insurance and financial consequences behind major events, subscribe to the USA Herald newsletter for exclusive investigative reporting and analysis.

Follow USA Herald on X at @RealUSAHerald.