German secret services are investigating the manipulation of cooling systems in European supermarkets. US authorities are also alarmed. But who is behind the attacks?
German intelligence services and the Joint Center for Combating Hybrid Threats (GAZ Hybrid) are investigating cyber attacks on cooling systems in supermarkets.
The attackers used automated search programs and known vulnerabilities in outdated software or standard passwords to manipulate cooling systems.
The Federal Office for Information Security and US authorities are calling on supermarket and cold storage operators to disconnect control systems from the Internet and update software.
The Office for the Protection of the Constitution sees a high risk of cyber attacks, particularly from Russian state actors and pro-Russian hacktivists, but emphasizes that it is unclear whether Russian hackers are behind the current attacks.
Berlin. After the cyber attacks on cooling systems in German and European supermarkets, the German intelligence services got involved. When asked by Handelsblatt, the Federal Office for the Protection of the Constitution (BfV) said: "The incidents are the subject of current intelligence investigations. The 'Joint Center for Combating Hybrid Threats' (GAZ Hybrid) is also dealing with the issue."
Security authorities and intelligence services work together in the center. In addition to the Office for the Protection of the Constitution, these also include the Federal Intelligence Service (BND) and the Military Counterintelligence Service (MAD). The central task of the GAZ Hybrid is, among other things, to detect and combat espionage, sabotage, state terrorism and other forms of hybrid threats.
It is still unclear whether the attacks on the cooling systems are part of a coordinated sabotage campaign against the European food supply. “At the moment, the Federal Ministry of the Interior has no information that would allow these attacks to be clearly attributed to a specific actor or government agency,” a ministry spokesman told Handelsblatt. A final assessment requires detailed analysis.
Supermarkets in North Rhine-Westphalia, Lower Saxony and Bavaria were affected. The attacks have now also reached numerous other European countries. Cyber attacks have also been reported in recent days on supermarkets in Belgium, Sweden, Ireland, Luxembourg, Estonia, Finland and the Netherlands. In France, blood bank cooling systems were also attacked. But the attacks were discovered in time.
The attackers apparently used automated search programs to locate open systems on the Internet and gained access via known vulnerabilities in outdated software or unchanged standard passwords. Affected systems were not just shut down. The perpetrators also specifically activated the defrost or heating mode. As a result, temperatures in refrigerator shelves and freezers sometimes rose to up to 50 degrees. Large amounts of food spoiled and had to be destroyed.
“The manipulation of control systems with the aim of destroying goods is a serious incident,” said the Interior Ministry spokesman. The attacks “once again highlighted the risks posed by industrial facilities directly connected to the Internet.”
The Federal Office for Information Security (BSI) therefore renewed its security warning on Tuesday. Operators should prevent direct access to industrial control systems from the Internet and update their software.
The American security authorities are also sounding the alarm. A joint statement from the FBI, the cybersecurity agency CISA and the ministries of health, transportation and agriculture said unknown hackers were targeting vulnerabilities in temperature controllers connected to the Internet.
Authorities also called on supermarket and cold storage operators to disconnect their control systems from the internet, isolate them from corporate networks and immediately install software updates.
The German Office for the Protection of the Constitution explained: “The current findings indicate that known vulnerabilities in the affected control systems are being exploited.” At the same time, the domestic intelligence service points to the growing threat from foreign secret services. “Germany is the focus of foreign secret services.”
Commercial companies and operators of critical infrastructure (Kritis), for example in energy supply, water supply and healthcare, are particularly at risk.
The Federal Office for the Protection of the Constitution rates the threat from Russia as particularly high. “There is a persistently high risk of cyber attacks by Russian state actors, particularly in response to European Union sanctions and in connection with Germany’s support for Ukraine.”
The authority cited an incident in Poland as an example. In December 2025, the Russian group “Berserk Bear” carried out a successful attack on the Polish energy supply there. The hackers attacked control systems in substations and combined heat and power plants. Substations distribute electrical energy in the power grid, while combined heat and power plants generate electricity and heat at the same time.
The Office for the Protection of the Constitution also warns of pro-Russian hacker groups. Since July 2024, such “hacktivist groups” have claimed attacks on inadequately protected IT systems, including controls of small hydroelectric power plants and video surveillance cameras. “These attacks, some actual and some alleged, have so far achieved the effect intended by the attackers, especially in the information space,” explained the authority.
The Office for the Protection of the Constitution left it open whether Russian hackers were also behind the current attacks on the refrigeration systems of European supermarkets.
The Federal Government currently does not see any immediate threat to the food supply from the current incidents. The companies affected are companies “below the so-called criticality thresholds”.
Critical infrastructure is considered to be systems whose failure could endanger the supply of supplies to many people. What is decisive are legally defined threshold values for the respective type of system, which are based on a guideline value of 500,000 people served.
According to the Interior Ministry, the current incidents are being evaluated in the National Cyber Defense Center (Cyber-AZ). Germany also exchanges ideas with European partner authorities.
