Suspected cyberattacks disrupted supermarket refrigeration in at least nine European countries overnight Sunday, three weeks after a similar attack hit hundreds of French stores. No one has claimed responsibility for either.
Grocers in Sweden, Belgium, Ireland, Italy, Portugal, Finland, Estonia, Luxembourg and the Netherlands reported problems, according to a wire report. A post by The Europeans X account claimed 13 countries had signaled possible attacks by 21:00 CET Monday. It added Denmark, Germany, Poland and Romania, and reports have not confirmed attacks in those four.
In Belgium, about 40 Delhaize stores, at least 15 Carrefour stores and five Spar stores were affected, according to Belgian media, and some fridges reached as high as 70C. Delhaize called it an “IT incident.” The Ikea store in Mons also suffered an outage, and four Delhaize stores in Luxembourg reported problems. Belgium’s federal prosecutor has opened an investigation, and Italy’s government planned to meet intelligence services Tuesday.
Several ICA stores in Sweden threw out stock after their freezers were set to 50C, and Coop confirmed problems at six stores. ICA has not confirmed a cyberattack, though the affected stores all rely on a Danfoss refrigeration control system run outside the chain. The group behind Intermarché in Portugal confirmed incidents at seven stores.
Sponsored · Selkirk Copper Mines
Read: ICA Group Yet to Confirm Cyberattack After Stores Report Freezers Heated to 50 Degrees Celsius
In Italy, Coop supermarkets in Sicily and a business in Tuscany reported attacks. In Ireland, wholesaler Musgrave emptied frozen stock at 13 SuperValu stores. Finnish grocer Kesko has not ruled out network interference at several small stores, and a refrigeration contractor in Estonia said it blocked an intrusion within minutes, according to a roundup of the reports. Danfoss told a Dutch broadcaster that attackers hit systems at 17 Dutch companies, according to a separate report.
The attackers remotely switched evaporators to defrost mode, which warmed the fridges, Belgian press reports said. Stephan Moelans, chief executive of Belgian refrigeration firm Sabcobel, said his technicians spent the night cutting affected units off from the network. A full fix needs a software update and physical changes to the units, he said.
French cybersecurity agency ANSSI said the October attack hit control systems from Danfoss, Copeland and Dixell. Danfoss has said most of the affected controllers in France were legacy models running outdated firmware that no longer receive security updates.
Read: Paris Prosecutors Open Probe After Hackers Heat French Store Fridges to 50C
Retailers connect the controllers to the internet so contractors can diagnose faults and change settings without dispatching technicians to every store, according to research by the security firm Forescout, which found vendors support internet access for installing, diagnosing and maintaining the units. Danfoss says the connection typically cuts unnecessary service call-outs by 15% to 30% and lets its monitoring teams triage alarms around the clock. It also logs temperatures automatically, so staff do not check each cabinet by hand up to four times a day to meet HACCP food safety requirements, the company says.Â
Vendor documentation describes setups that expose the controllers to the public internet through port forwarding or a public IP address, Forescout found, and the firm said the exposure does not necessarily stem from careless customer configuration. Baptiste Robert of Predicta Lab counted 2,752 Danfoss systems reachable from the open internet on October 12, with 1,590 of them in France. A Danfoss spokesperson urged Dutch customers in mid-October to disconnect their systems from the open internet, according to reports.
Nobody has identified the attackers, and Belgium’s Centre for Cybersecurity said investigators may never learn who is behind it. Moscow has repeatedly denied running sabotage campaigns in Europe, and no public evidence links Russia to the attacks.
Also read: Break-Ins Hit Nearly 20 Finnish MPs’ Homes, Russia Suspected
EU Agriculture Commissioner Christophe Hansen called the incidents “a deliberate attempt to disrupt our food supply chain,” though he did not name a culprit.
