In a concerning development, hackers have infiltrated supermarket refrigeration systems in at least ten European nations, disrupting the food supply chain by altering temperature controls. This breach has compelled retailers to pull chilled and frozen products from their shelves as temperatures soared.
Widespread Impact Across Europe
The incidents, which came to light on November 2, have exposed vulnerabilities within the food industry’s connected systems. Reports indicate that temperatures in some affected stores reached a staggering 50°C (122°F). Countries impacted include Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Germany, and Sweden.
European Union officials have expressed concern that these attacks might be a deliberate attempt to destabilize the food supply. Although no organization has taken responsibility, and the perpetrators remain unidentified, the potential implications are significant.
Country-Specific Consequences
The ramifications of the attacks varied across different countries and retailers. In Ireland, the Musgrave Group confirmed that 13 SuperValu stores suffered disruptions, but efforts to restock began promptly. In Portugal, the Mosqueteiros group linked disruptions at seven Intermarché outlets to an external refrigeration contractor’s breach.
In Sweden, retailers like ICA and Coop reported similar issues, with some stores noting unauthorized temperature settings. Notably, one store’s refrigeration units were adjusted to 50°C, a critical shift that could threaten food safety if left unchecked.
Security Concerns and Response
These cyberattacks target operational technology, specifically the systems that regulate physical processes like refrigeration. Such systems are crucial for maintaining food safety, but remote access intended for maintenance can become an entry point for hackers if not adequately protected.
Several incidents have been linked to Danfoss equipment, a Danish manufacturer of refrigeration control systems. Although Danfoss confirmed its involvement, no single flaw or entry point has been identified, highlighting the complexity of these breaches.
Previous attacks in France, affecting about 700 stores, underscore the potential financial impact, with losses estimated in the tens of millions of euros. Investigations are ongoing, focusing on device logs and configurations to understand the methods used.
Future Outlook and Recommendations
EU officials, including agriculture commissioner Christophe Hansen, have warned of potential future disruptions. The European Commission emphasizes the need to secure essential services against cyber threats, calling for immediate protective measures.
Recommendations include removing control interfaces from public networks, updating system firmware, changing default passwords, and securing remote connections. The UK’s National Cyber Security Center advises updating older systems that may lack current security patches.
These incidents highlight the critical role of secure remote systems in safeguarding the food supply chain, emphasizing the need for robust cybersecurity measures to prevent future breaches.
