A recent cyberattack has compromised refrigeration systems in over 100 stores across Europe, affecting both large chains and smaller retailers. The incidents, which occurred overnight from Sunday to Monday, have been attributed to a cyberattack, though no group has claimed responsibility. This disruption closely mirrors earlier attacks that caused chaos in European supermarkets three weeks ago.
Impacted Regions and Initial Findings
The affected stores span several countries, including Belgium, Estonia, Ireland, Luxembourg, the Netherlands, and Sweden. Some refrigeration units were raised to temperatures as high as 50°C (122°F). Additional reports of compromised refrigeration have emerged from Finland, Italy, and Portugal. Investigators are still determining if there is a connection between this wave of attacks and the previous one.
Earlier attacks struck France, affecting approximately 700 supermarkets. Among them were major retailers like Intermarché, Carrefour, Coopérative U, and Monoprix. The incidents resulted in spoiled food and even fires in some locations. France’s cybersecurity agency, ANSSI, initially linked these breaches to Danfoss AK-SM and AK-SC controllers, later expanding the alert to include Copeland and Dixell XWEB systems.
Technical Details and Security Measures
According to Stephan Moelans, CEO of Belgian refrigeration firm Sabcobel, the attackers deployed a technique similar to that used in the French incidents, driving refrigeration units into defrost mode. Moelans emphasized that software updates alone are insufficient to safeguard the equipment; physical modifications are also necessary. Danfoss advised its customers to disconnect their systems from the internet and only reconnect through secure networks.
Security researcher Kevin Beaumont noted that accessible internet interfaces were a common factor among affected freezers. Many of the compromised devices are outdated and lack available patches. Deception security firm Lupovis observed suspicious activity targeting their Danfoss AK-SM sensors, primarily relying on default credentials.
Impact on Retailers and Industry Response
Belgium experienced significant disruptions, with Delhaize reporting issues at several stores and Carrefour noting 15 affected locations. In Luxembourg, four Delhaize stores were impacted. Ireland’s SuperValu faced challenges at 13 stores due to specific refrigeration models being targeted. Swedish retailer ICA and the Netherlands also reported disruptions.
EU agriculture commissioner Christophe Hansen described the attacks as an intentional effort to disrupt the food supply chain and undermine consumer confidence. While he assured that the EU’s food security remains intact, he acknowledged the considerable food waste and business impact caused by these incidents.
As the investigation continues, the focus remains on enhancing cybersecurity measures across the food retail industry to prevent future attacks and ensure the stability of the food supply chain.
