EXPLORINEER
en

DE — heise online

Supermarket Cooling Systems: German Intelligence Agencies Investigate Sabotage Attacks

Security2 min read

German intelligence agencies have joined the investigation into cyberattacks that manipulated the cooling systems of supermarkets. The attacks have now reached several other European countries.

What happened

Hackers broke into the cooling systems in supermarkets and changed the temperature settings of fridges and freezers. Police are investigating, and German intelligence services have now joined in. The domestic intelligence agency (BfV) says the cases are part of its current intelligence investigation.

Key facts

  • Attacks have hit supermarkets in Germany (North Rhine-Westphalia, Lower Saxony and Bavaria) and in several other European countries.
  • Countries named in the article include Belgium, Sweden, Ireland, Luxembourg, Estonia, Finnland and the Netherlands.
  • In France, the cooling systems of blood banks were also targeted, but these attacks were found in time.
  • Some fridge shelves reached up to 50 degrees Celsius, so large amounts of food spoiled and had to be destroyed.
  • The government says the affected companies are below the threshold for critical infrastructure, which is based on about 500,000 people supplied.

How the attacks worked

The attackers used automated search tools to find open systems on the internet. They got in through known weaknesses in old software or through standard passwords that were never changed. In at least one case, the attack came through an outside maintenance company. The attackers did not just switch the systems off. They turned on defrost or heating mode, which made the food get warm.

Why it matters

It is still unclear whether the attacks are part of one coordinated plan to harm Europe's food supply. Officials in the United States and Germany have warned companies to close direct internet access to these controls and to install updates. The case shows how risky it is when remote access to connected machines is not well protected.

What to watch

  • Whether the intelligence services link the attacks to a specific group or government.
  • How the joint German centre for hybrid threats (GAZ Hybrid) continues its work on the case.
  • Whether companies check and secure their remote maintenance access.
  • How the European Cyber Resilience Act (CRA), which requires makers of digital products to meet security rules, will affect these systems over time.

Glossary

BfV
Germany's domestic intelligence agency, which protects the country from threats such as spying and sabotage inside Germany.
GAZ Hybrid
A joint German centre where police and intelligence services work together against hybrid threats like spying and sabotage.
Cyber Resilience Act (CRA)
An EU law that requires makers of digital products to meet security rules throughout the product's life.

Same story, different eyes

Ad

Add 150 words. Learn 10 a day.

Dicter word books send only the words you learn to your review notes.

More in this topic

Security전자신문

Government Warns of Refrigeration Equipment Hacking, Urges Private Sector Security Checks

Amid a string of overseas hacks on refrigeration equipment that caused food spoilage, South Korea's Ministry of Science and ICT has shared foreign cases with private operators and industry groups and recommended security inspections. Attackers targeted remote control devices that can change equipment temperature and operating hours from outside stores or cold storage facilities. Recommended measures include changing default passwords, updating firmware, and restricting external access to protected networks such as VPNs; the ministry says no domestic damage has been reported so far.

Securityheise online

Brenner Base Tunnel: Cyberattack on Construction Company

The project company building the Brenner Base Tunnel between Austria and Italy, BBT SE, was the target of a cyberattack in mid-October. Unknown attackers accessed parts of data that could be reached from the internet, but BBT said no risks to construction or future operation arose and high-security data was not affected. Italian authorities are leading the investigation, as BBT is based in Bolzano.

SecurityThe Register

NHS breach helpline left staff carrying a 'significant emotional burden'

A review has found that NHS staff drafted into a helpline after colleagues' health data was exposed online faced distressed callers, safeguarding decisions, and a "serious emotional impact." The helpline was meant to run for two weeks in December 2025 but was stood down after 11 weeks, in February 2026. The breach at Royal Cornwall Hospitals NHS Trust affected 8,003 people and stemmed from a spreadsheet published in February 2023 that retained sickness absence records accessible through its pivot tables.

SecurityZDNet Korea

"I Thought It Was a Robot Malfunction, but It Was a Hack": Physical AI Faces Growing Security Threats

As AI expands into robots and self-driving cars, cyberattacks that subtly distort AI perception can be hard to tell apart from normal environmental adaptation, potentially causing injuries or equipment accidents. Gartner's report says traditional network-centric security is not enough, recommending physical safety mechanisms independent of AI models, separation of security inspections from real-time control paths, and independent monitoring systems.