Ing. Calogero Bono
After France, cyberattacks on supermarket refrigeration systems have reached Italy too. In Sicily, the display fridges of at least four stores under the Coop brand were tampered with remotely, while ACN reported two more cases in Tuscany and Emilia-Romagna. The government speaks of limited impact, but the issue concerns anyone with equipment connected to the Internet. A poorly protected remote access can turn into physical damage and stock to throw away.
A few terms before we get into the facts. ACN is the National Cybersecurity Agency. Scada refers to platforms that supervise many machines from a single point. HMI is the interface through which an operator controls a plant. OT covers systems that govern physical processes, such as compressors and temperatures. Multi-factor authentication means requiring a second verification element in addition to the password.
What happened to supermarket fridges?
According to Punto Informatico, after France, fridges and freezers in supermarkets were hit in Italy, Belgium, Ireland, Luxembourg, the Netherlands, Estonia, Sweden and Finland. Temperatures were pushed up to 50 degrees Celsius and the products will have to be thrown away. The damage has not been precisely quantified, but figures in the millions of euros are being mentioned.
For the broader picture, see also our article on what happened and what to do.
What happened in Italy?
According to DDay, the attack in Sicily took place at 4 in the morning. Three stores in Catania and one in Palermo were hit, run by the Radenza group under franchise. General manager Giuseppe Spadaro said the problem was contained. The Postal Police are investigating where the attacks came from.
ACN also reported an NIS notification from a Tuscan collective catering company and an attack, not yet notified, on an Emilian frozen food producer. The names have not been released. After the meeting at Palazzo Chigi, the government spoke of an impact that was "strongly limited" compared with the thousands of points of sale nationwide.
How did the attackers operate?
Remote control lets technicians read temperatures, receive alarms and schedule defrost cycles. According to Cybersecurity360, if a console is exposed or a maintenance access is poorly protected, whoever breaks in can change the physical parameters of the system.
ACN recalls the mechanism seen in France, based on obsolete equipment, exposed interfaces and weak authentication. In Sicily, according to Punto Informatico, unknown actors found the public IP addresses of the systems. Danfoss systems are present in all the supermarkets, and the Danish company confirmed the second compromise. About 5,000 systems remained vulnerable despite the warning to disconnect, update and protect them.
What checks does ACN ask for?
The bulletin indicates six areas.
- Inventory controllers, HMIs, Scada, gateways and supplier cellular routers.
- Remove public access and separate OT networks from corporate ones.
- Use VPNs with multi-factor authentication and limited permissions.
- Delete unused accounts and change default passwords.
- Compare temperatures, defrost cycles and alarms with approved configurations.
- Verify firmware and support, planning replacements.
The bulletin also invites analysing logs going back 90 days, where they are kept. Before restarting or disconnecting anything, coordinate with those who know the system, so as not to make the damage worse.
Limits to know
It is not proven that the Italian and European incidents share the same technical origin or the same perpetrators. The sources do not show that the vulnerabilities CVE-2025-41451 and CVE-2025-41452 in Danfoss AK-SM 8xxA controllers, fixable with firmware 4.3.1, were exploited in November. The bulletin does not list affected companies or estimate damages, and the names of the Tuscan and Emilian firms remain unknown.
What changes for those working with digital systems
If you manage or maintain connected equipment, you need to know what is reachable from the Internet. You need an inventory per site with model, version and owner. Cellular routers and access left open by maintenance technicians often escape the IT department. A simple login page or an encrypted connection is not enough. Servers and exposed panels call for the same discipline as managed hosting and servers with security updates. Supplier contracts, access windows and session logs become part of security.
Our take
The lesson is unglamorous. No sophisticated techniques are needed, just exposed addresses and factory passwords, as in the small Dutch shops. The government is right to stress the limited scope of the impact, but 5,000 systems still vulnerable after the French warning show that bulletins alone are not enough. The security of physical equipment is still treated as a supplier's issue, while responsibility stays with whoever operates the machine. Anyone buying connected equipment should ask for updates and support in writing.
Frequently asked questions
Which Italian regions were hit?
The sources cite Sicily, with four Coop franchise supermarkets, then Tuscany and Emilia-Romagna with two food companies. No further details have been released.
Who makes the affected equipment?
According to Punto Informatico, Danfoss systems are installed in the supermarkets, and the company confirmed the compromise. The sources do not show, however, that a specific flaw was exploited.
What does ACN recommend for remote access?
A corporate VPN with multi-factor authentication. Each technician should reach only the equipment under their responsibility, and default credentials must be replaced.
What is an NIS notification?
It is the mandatory reporting of cyber incidents that European rules impose on companies in certain sectors, including part of the food supply chain.
Is it enough to take a system off the Internet?
No, not by itself. You also need to check that temperatures, defrost cycles and alarms have not been altered, and preserve logs before restoring service.
What to watch for in the coming weeks on connected equipment
The Postal Police investigation and ACN's work will show whether the cases are linked. In the meantime, it makes sense to act on the most concrete points.
- Follow the investigation into the origin of the attacks and any link with other European countries.
- Ask your maintenance providers for a written list of active remote accesses and service windows.
- Schedule the replacement of out-of-support devices with budget, owners and deadlines.
