A wave of supermarket refrigeration cyberattacks has struck Italy, disrupting remote temperature controls across four Coop grocery branches in Sicily. The overnight breach forced store workers in Catania and Palermo to throw away stocks of overheated food on Wednesday morning, as domestic security agencies opened an investigation into wider food sector threats.
Key points
- Hackers breached remote control platforms managing frozen-food units at three Coop stores in Catania and one in Palermo.
- National cybersecurity authorities detected additional digital intrusions targeting catering and frozen food businesses in Tuscany and Emilia.
- Italian intelligence leaders and cybersecurity officials called urgent meetings to evaluate cross-border links to similar cooling attacks across Europe.
The incident in Sicily targeted digital management systems that regulate commercial cooling equipment. Intruders manipulated the digital consoles to disable normal cooling functions, mirroring strikes seen earlier this week across Europe where hackers forced commercial chilling systems to surge past 50 degrees Celsius at around 4 am.
Giuseppe Spadaro, general manager of the Radenza group, which operates the affected Sicilian Coop branches, confirmed the breach to Italian news agency Ansa. Store technicians discovered the disruption when morning crews arrived to find displays ruined by excessive heat.
Danilo Radenza, chief executive of Coop Radenza, said: “We have verified that it is an attack on our remote control system for frozen-food counters. After a careful screening it appears there is no further damage, but the attack did take place.”
Attacks spread across Italian food networks
The damage in Italy extends beyond retail grocers on the island of Sicily. The National Cybersecurity Agency (Acn) confirmed it has received reports detailing similar operational intrusions against other food logistics companies on the mainland.
Agency monitors detected unauthorised activity aimed at a catering business based in Tuscany, alongside a breach involving an industrial frozen-food manufacturer operating in Emilia. Italian postal police investigators have begun examining the digital telemetry from each company to verify if common network access pathways or software vulnerabilities tie the intrusions together.
Italian officials are tracing technical indicators to determine whether the Sicilian incidents match the coordinated wave where a supermarket refrigeration cyberattack hits stores across six European nations. Earlier intrusions disrupted approximately one hundred supermarkets across Sweden, Belgium, Luxembourg, Estonia and Ireland. Security services also monitored an earlier disruption when a supermarket refrigeration cyberattack hits Belgium and Sweden before expanding eastward.
How attackers manipulated cooling telemetry
Industrial refrigeration units in modern food retail rely heavily on automated building management systems and internet of things controllers. Facility operators deploy remote management software to let technicians adjust thermal cycles, balance electrical loads and read sensor anomalies without visiting physical equipment rooms.
When these administrative dashboards remain directly accessible over the public internet without network isolation, attackers can alter setpoints en masse. By raising thermostat target values to maximum limits or cycling cooling compressors off during early morning hours, intruders destroy perishable stock while bypassing basic local hardware alarms.
In response to the Sicilian incidents, Acn issued urgent security guidance to the Italian logistics and food retail sector. The agency advised supermarket operators to audit digital environments immediately, verify that supervisory control interfaces are not exposed to the public internet, and route all technician access through secure virtual private networks with multi-factor authentication.
Acn also instructed infrastructure teams to audit privileged administrative credentials and decommission legacy industrial controllers that no longer receive manufacturer security patches.
Government convenes national security leadership
The systemic targeting of food temperature controls has escalated from commercial vandalism into a critical infrastructure emergency for Rome. The European Union has characterised the coordinated tampering as “highly worrying” following an earlier assault on 12 October that crippled refrigeration networks across French grocery chains, inflicting millions of euros in product losses.
In Italy, the Parliamentary Committee for the Security of the Republic (Copasir) scheduled formal inquiries to seek briefings from the cabinet. Meanwhile, the office of the Prime Minister at Palazzo Chigi organised high-level talks coordinated by Alfredo Mantovano, the undersecretary to the prime minister’s office.
That session brings together the director of the National Cybersecurity Agency and leaders of Italy’s intelligence services to evaluate systemic supply chain risks. No hacker collective has taken credit for the Italian breaches, though security analysts are treating the events as a coordinated cross-border campaign.
Acn is scheduled to hold technical briefings on Thursday with industry federations and major retail executives to review security postures across the national food supply network.
