Hybride Bedrohungen: Cyberattacken auf Supermärkte werden Fall für die Geheimdienste

German intelligence agencies have become involved in investigating cyberattacks on refrigeration systems of German and European supermarkets. The Federal Office for Protection of the Constitution (BfV) stated that "the incidents are the subject of ongoing intelligence investigations" and that the "Joint Center for Combating Hybrid Threats (GAZ Hybrid)" is also looking into the matter.

GAZ Hybrid is a center where security authorities and intelligence services cooperate, with a central mission to detect and combat espionage, sabotage, state terrorism and other forms of hybrid threats. It is unclear if the refrigeration attacks were part of a coordinated sabotage campaign against European food supply, according to a ministry spokesperson.

The attacks affected supermarkets in North Rhine-Westphalia, Lower Saxony and Bavaria, but have since spread to numerous other European countries including Belgium, Sweden, Ireland, Luxembourg, Estonia, Finland and the Netherlands. In France, blood bank refrigeration systems were also targeted. The attacks were stopped in time, and the intruders activated the defrost or heating mode, causing temperatures in refrigerated and frozen sections to rise up to 50 degrees Celsius.

This led to the spoilage of large quantities of food. US authorities have issued an alarm, stating that the manipulation of control systems aimed at destroying goods is a serious incident. The Federal Ministry of the Interior explained that the attacks highlighted the risks posed by industrial plants connected directly to the internet.

The Federal Office for Information Security (BSI) has therefore renewed its security warning, urging operators to prevent direct internet access to industrial control systems and to update their software. The American cybersecurity authorities have also sounded the alarm. In a joint statement, the FBI, Cyberspace Safety Agency CISA, and the ministries of Health, Transport and Agriculture said that unknown hackers had been targeting vulnerabilities in temperature regulators connected to the internet.

They advised supermarket and refrigeration operators to isolate their control systems from the internet and company networks, and to install software updates immediately. The German Federal Office for Protection of the Constitution noted that the current evidence suggests the exploitation of known vulnerabilities in the affected control systems.

It also pointed to the growing threat from foreign intelligence services, warning that "Germany is in the crosshairs of foreign intelligence services." The security office particularly emphasized the danger from Russian state actors, citing a 2025 incident in Poland where the "Berserk Bear" group successfully attacked the country's power grid by targeting control systems at substations and block heating power plants.

The Verfassungsschutz warned of a high risk of cyberattacks by Russian state actors, particularly in reaction to European Union sanctions and in connection with Germany's support for Ukraine. The attacks on refrigeration systems in European supermarkets used automated programs to scan open systems on the network and gain access through known vulnerabilities in outdated software or unchanged standard passwords.

Affected facilities were not only shut down, but the attackers also intentionally activated the defrost or heating mode, raising temperatures in refrigerated and frozen sections to up to 50 degrees Celsius, causing the spoilage of large amounts of food.