Hacker attacks overheat supermarket freezers in Italy and Europe, government sees no alarm

Attacks reach Sicily and the cold chain

Cyberattacks that altered the temperature settings of refrigerated display cases have reached Italy. A new wave on 2 November hit the cooling systems of several European supermarkets, and in Sicily stores including Coop outlets in the Palermo and Catania provinces saw display-case temperatures change, damaging food. At least four Coop stores in the Radenza group were affected, three in Catania and one in Palermo, and similar disruptions are under investigation in Tuscany and Emilia Romagna. The general director, Giuseppe Spadaro, said the altered settings overheated the food counters and made products deteriorate. The Polizia Postale is reconstructing how the intrusions happened and checking for links to the episodes abroad.

Catania3

Palermo1

Catania

3 stores

Palermo

1 stores

Data from the article text

The pattern extends beyond Italy. In the night between Sunday 1 and Monday 2 November, supermarkets in Sweden, Belgium, Ireland, Estonia, Luxembourg and Finland reported freezers that had turned into ovens, as did some stores in Italy. No group has claimed the simultaneous attacks. The case that preceded them was in France, where on 12 October employees at several supermarkets found frozen goods thawed after display-case temperatures had reached 50 degrees overnight.

How the attacks work

The vulnerability was verified on 9 August. Claroty, the cybersecurity firm behind the research, said it could gain root-level command execution on a laboratory device in about 28 minutes, at a cost of $6 for AI use. A step-by-step manual for manipulating Danfoss Ak-SM 800A controllers has circulated online since August, and almost 3,000 devices had not been updated in the 63 days before the French attack.

Paolo Dal Checco, a cybersecurity expert and forensic IT consultant, lists three hypotheses: a password found elsewhere, a phishing campaign used to obtain credentials, or outdated control software, which he considers the most likely. On the motive, he said:

“Generally, whoever carries out an attack wants money.”

No money was demanded and no data was taken, which he said points to a demonstrative act, a hacker acting for fun, or a warning about something worse. Antonella Maugliani, a researcher at the Istituto superiore di sanità, said food exposed for a limited time is judged case by case, while long exposure makes precaution the priority. Cold halts bacteria rather than killing them, and thawing lets them multiply and sometimes produce harmful toxins.

Government and industry response

Palazzo Chigi held a meeting chaired by Alfredo Mantovano, the delegated authority for national security, with agriculture minister Francesco Lollobrigida, intelligence chiefs and ACN director Andrea Quacivi. Piantedosi described the episode as a coordinated act, while Lollobrigida called it a hybrid threat. Quacivi then convened an urgent meeting with large retailers and the agriculture ministry to strengthen information sharing. The government's note said there is no cause for alarm:

“The large majority of the distribution chain has updated protection systems capable of repelling malicious intrusions.”

Carlo Alberto Buttarelli, president of Federdistribuzione, said:

“No critical issues are being recorded in the distribution networks of our companies, medium and large.”

Paolo Mascarino, president of Federalimentare, said Italian food companies are fully operational and food supply continuity is not in question. Consumer groups Adoc and Codacons expressed concern.

The DDoS wave against logistics and public bodies

From 7 to 21-22 October, the pro-Russian collective NoName ran DDoS attacks against Italian public platforms and transport, marine and logistics firms. The first hit, on 7 October, targeted the Hub dei contratti pubblici, a procurement platform linked to the transport ministry, which said the attack was neutralised the same day. About 24 hours later the group struck the Farnesina, after Russian spokesperson Maria Zakharova attacked Antonio Tajani. The campaign then widened to companies such as Azimut Benetti Group and Neri Group, where orders stopped, shipments halted and portals went down for hours or days. The economic cost has yet to be quantified.