Retailers in Belgium, Sweden, Estonia and other European countries reported overnight attacks on refrigeration controls that caused fridges and freezers to warm. Some stores removed chilled and frozen products from sale or discarded them. No individual chain reported more than several dozen affected locations.
Danfoss, a Danish manufacturer of refrigeration controls, said its products were involved in the incidents, as they had been in attacks on hundreds of French supermarkets three weeks earlier. As of Monday night, no one had claimed responsibility, and it was not known whether the European incidents were connected to the French attacks.
The controls are computers that operate store refrigeration systems and can be connected to the internet so contractors can monitor and repair them remotely. In Belgium, attackers switched some units into defrost mode, which caused them to heat rather than keep food cold, according to Stephan Moelans, chief executive of refrigeration contractor Sabcobel. In other cases, temperatures were raised directly. An ICA store in southern Sweden said its refrigeration settings had been changed to 50°C, while a freezer at an Estonian Selver store was also set to 50°C. The Estonian unit warmed by only about 2–3°C, and the issue was resolved in around 10 minutes without damage to products.
The reported incidents affected retailers and businesses in multiple countries, though the scale and impact varied. Delhaize said several dozen stores, mostly in Belgium and a few in Luxembourg, had refrigeration problems that temporarily limited fresh and frozen food selection. Carrefour reported an impact at 15 of its more than 700 Belgian stores, while Intermarché reported 10 to 15 affected locations. In Sweden, Coop said six or seven of its roughly 800 stores were affected; ICA did not provide a count. Ireland’s Musgrave, which owns SuperValu, said 13 of its 223 stores were affected and removed chilled and frozen products as a precaution. The company said the incident had been resolved and restocking was under way.
Other reports included five independently owned Spar stores in Belgium, one IKEA store in Mons, one Selver store in Estonia, at least 17 unnamed businesses in the Netherlands, a few smaller Kesko stores in Finland, seven Intermarché stores in Portugal and at least four Coop supermarkets in Sicily. A butcher shop in Hove, Belgium, also reported that its fridges had been raised to as high as 18°C. Its owner estimated that about €15,000 of meat was ruined.
Several affected systems were made by Danfoss. In the Netherlands, the company said, the targeted systems were not on secure networks and still used default passwords. Danfoss also told Belgian media that outdated software was a major weakness and that customers who had not updated their systems were affected. In Estonia, the attack targeted an older Danfoss system, according to refrigeration supplier Kitman Coldtech. A Belgian butcher also told Dutch broadcaster NOS that equipment from another manufacturer, Copeland, had been attacked.
The available information does not establish who carried out the attacks. Danfoss, Sabcobel and Kitman said the incidents in the Netherlands, Belgium and Estonia used methods similar to those in France, but that similarity does not prove the attacks were carried out by the same people. Belgium’s Centre for Cybersecurity said the perpetrators were unknown and might never be identified. The country’s federal prosecutor has opened a criminal investigation, while Sweden’s National Cybersecurity Centre said it was monitoring the incidents and sharing information with agencies elsewhere in Europe and the Nordic region.
An October alert from France’s national cybersecurity agency, CERT-FR, covers Danfoss AK-SM and AK-SC controllers and Copeland xweb and Dixell xweb systems. Its recommendations include preventing devices from being directly reachable over the internet, checking configurations such as defrost schedules, using secure networks or VPNs for remote access, updating firmware and replacing default passwords. For compromised devices, the alert advises restarting or resetting them and reconfiguring them before returning them to service. It warns that end-of-life devices without security updates are especially vulnerable if left connected to the internet.
Sources: The Hacker News.