More than 300 refrigeration control systems in Greece are exposed to the internet, posing a potentially serious risk to supermarkets and food retailers.
The threat is not the theft of personal data or the compromise of electronic payments, but the ability of hackers to interfere remotely with the operation of refrigerators and freezers, destroying stocks of fresh and frozen goods within hours.
That is why the National Cyber Security Authority sent an urgent letter yesterday, Tuesday 3 November, to the Union of Supermarkets of Greece and its president, Ioannis Masoutis, calling for businesses in the sector to be notified immediately.
According to the Authority, more than 300 similarly exposed systems have been identified in the Greek market, mainly commercial refrigeration controllers made by Danfoss, Copeland/Dixell and Carel.
The warning follows a growing wave of attacks across Europe. On the night of 1–2 November, more than 100 stores were affected in Belgium, Luxembourg, Sweden, Ireland and Estonia. The chains targeted included Delhaize, Carrefour, Spar, ICA, Coop and SuperValu.
This followed an attack in France on the night of 11–12 October, which affected around 700 stores, according to the technical report «Setpoint 50°C» by CyberPax. At Intermarché and Netto alone, the number of affected sites was estimated at between 180 and 300, while problems were also reported at stores operated by Coopérative U, Carrefour, Monoprix and Leclerc.
The method used helps explain how a cyberattack can cause such extensive material damage. The attackers are believed to have gained access to refrigeration controllers and triggered prolonged defrost cycles, raising the temperature setpoint to 50 degrees Celsius. In some cases, defrost cycles were extended from one hour to eight, while even higher temperatures and equipment damage were also reported.
The financial cost was significant. According to CyberPax, the head of France’s Intermarché cited tens of millions of euros in damage nationwide, while a Leclerc store in Alsace reportedly lost goods worth €220,000. In Belgium, a meat-trading business reported losses of around €15,000 after the temperature in a cold room rose to 18 degrees.
According to the same report, a check on 12 October found 2,752 Danfoss consoles accessible from the internet, including 1,590 in France. The Greek market was not included in that count. However, a subsequent investigation by the National Cyber Security Authority identified more than 300 exposed systems in the country.
The problem lies mainly with older controllers that no longer receive security updates, as well as the availability of permanent remote access for external maintenance contractors. Danfoss has confirmed that its products were affected by the recent incidents, while Greece’s Authority warns that similar equipment is also in use at stores in the country.
Alongside replacing obsolete equipment, CyberPax says businesses should check whether temperature alarms operate independently of refrigeration controllers that could be compromised. Otherwise, an attack could affect both refrigeration and the ability to alert staff in time.
The question of insurance cover also remains open. The report says businesses should check whether their policies cover cyber-sabotage affecting physical equipment and the resulting loss of goods, particularly when devices without security support are in use.
The National Cyber Security Authority is urging supermarket chains to disconnect refrigeration controllers from the public internet, allow access only through secure VPN connections with multi-factor authentication, and change default passwords.