Spain is not safe from hacking in supermarkets: “the most vulnerable businesses such as butcher shops or fruit shops”

In the middle of the night and without physically entering each establishment, cybercriminals left thousands of refrigerator doors open Wasting tons of food In supermarkets across Europe. A computer attack that could have been avoided.

Just four weeks later, the same cyber attack was repeated In European supermarkets. “The French CERT left a fairly specific list, a list of tasks” to protect the equipment and avoid new attacks like this, recalls Sancho Lrena, CEO and founder of FMS Pandora.

However, the list of responsibilities would not have been implemented in time to prevent a second wave of attacks. The most affected countries have been Belgium and Sweden, but there have also been problems in Luxembourg, the Netherlands, Italy, Ireland, Estonia and Latvia.

Spain seems to have escaped The attack, which allows refrigerator temperatures to be increased by remote control, spoils food. “Although we talk about big chains, the most vulnerable are small businesses such as independent shops, butchers or fruit shops,” recalls cyber security company Stoic.

The cyber security sector confirms that pressure has increased, with retailers averaging approx 2,200 attacks per week in Europe (43% YoY growth), according to Check Point. “Any business in Spain that has such equipment should review it as soon as possible,” explains Juan Ignacio Ramallo, Stoic’s country manager in Iberia.

In fact, the check point explains that of all the exposed interfaces identified globally, 8.4% in Spain. 31.2% in France, 8.6% in the United States, 7.5% in Belgium, 6.2% in Poland, 4.7% in the Netherlands, 3.3% in Sweden, 2.9% in Denmark, 2.4% in Kazakhstan and 2.2% in Germany.

These percentages represent the proportion of each country relative to the total number Globally identified open interfaceNot the percentage of open cooling systems within that country.

New hack

In the Netherlands, at least 17 butcher shops and nearby shops were affected. The manager of an ICA store, Sweden’s leading supermarket chain, told TV4 that the temperature setting had been changed to +50 °C (122 °F) overnight and could not be changed, forcing the store to throw out frozen food.

“The attack happened around 4 am (03H00 GMT)”, explained the director of the Radenza Group, which operates the Coop brand supermarket, Giuseppe Spadaro, to the Italian news agency ANSA.

Dutch multinational retail and wholesale holding company Ahold Delhaize alerted managers via SMS about refrigeration problems around 4 a.m., and some stores used refrigerated trucks to try to preserve stock.

Preliminary investigation, collected by special media Bleeping Computer, refers to Subcobel as the supplier of several cooling systems in the affected area. According to Subcobel director Stephane Moelans, the attacker exploited the same vulnerability used in a similar attack in France last month.

Attacked systems are cooling controllers Danfoss, Copeland and Dixel, Brands that are in supermarkets around the world, but there are no reports of affected supermarkets in Spain Experts have clarified that it is too early to know the exact reasons why this country would be spared, although it is possible that such an attack could happen at any time. No one has claimed responsibility for the attack and there is no reliable public attribution to any country, criminal group or specific actor.

solution

Since a similar incident happened in France last month, it’s easy to think that an update could protect systems in the rest of Europe from another hack. However, to eliminate this vulnerability exploited by cybercriminals, Subkobel assures that Changing the software remotely is not enough.

The company points out that to protect its customers’ systems, in addition to updating software, it is not enough, since refrigerators also require physical changes.

The French authorities have already indicated the procedures to be followed to protect the identified vulnerabilities. It is recommended to place the equipment behind a firewall, Change passwords among other measures, not with direct access to the Internet.

It’s quick to say, but implementing those responsibilities for thousands of teams deployed around the world is another story; “In the industrial environment there is equipment that has been working for ten or fifteen years and nobody wants to touch it because it ‘works’. That’s the problem, working means that it hasn’t failed yet.”

Experts point out that this is a common problem in an increasingly interconnected world Everything is controlled remotely. But where the effort to protect the system outweighs the damage caused by such incidents.

No one is saved

However, the weight on that scale is changing, mainly losses, as Pandora FMS emphasizes. “It’s what happens When you connect everything and never ask what happens if it fails.”.

A new report from the NCSC, part of Britain’s GCHQ spy agency, Claims that a ransomware attack by 2028 is very likely Against the nation’s critical infrastructure with AI-powered malware.

“In the coming months, we will face the real possibility of an unprecedented increase in the number of cyber incidents,” NCSC Executive Director Richard Horne said when launching the report.

in spain, INCIBE conducted 401 incidents in 2025 on essential and critical operators341. 18% higher than the previous year. And the total number of cyber security incidents increased by 26%.

This is a trend that will increase thanks to current tools that simplify and speed up the way technical teams discover and exploit vulnerabilities before patching them. It’s a race against time.

“The fact that there are no Spanish supermarkets on the list today may mean that they are better isolated, but also that the configuration is different or, simply, that they have not yet been identified,” explains Sancho Llerena, who warns that we should not claim victory. “The absence of certain events in a country May be due to certain technical reasonssuch as differences in network topology or driver versions”, Eusebio Niva, Technical Director of Check Point for Spain and Portugal.

Pandora FMS indicated that in previous attacks in October, some researchers had pointed to potentially affected equipment in Spain. Nevertheless, all expert advice agrees, “Once it appears, The attack method is fully replicable all over the world.”