By 
Remarkably, over 100 supermarkets across several European nations experienced significant refrigeration failures attributed to a series of cyberattacks. From Sunday night into Monday morning, the temperature in fridges and freezers at various locations soared dangerously high, sparking concerns about the impact on food safety and supply. This wave of attacks appears closely linked to similar incidents that unfolded just three weeks earlier, drawing a concerning parallel that may indicate a larger, orchestrated campaign.
Reports confirm that retailers in Belgium, Estonia, Ireland, Luxembourg, the Netherlands, and Sweden were among the hardest hit, with some refrigeration units reportedly reaching temperatures as high as 50°C (122°F). Additionally, disturbances were also observed as far away as Finland, Italy, and Portugal. While no group has claimed responsibility for these attacks, the pattern is starkly reminiscent of earlier breaches that saw about 700 supermarkets in France fall victim overnight from October 11-12.
These initial attacks forced major grocery chains, including Intermarché, Carrefour, and others, into a state of crisis, leading to substantial food spoilage and, in some instances, fires within the stores. The French cyber incident response team, CERT-FR, promptly associated these compromises with vulnerabilities in specific models of Danfoss refrigeration controllers, only to discover later that similar issues existed with Copeland and Dixell systems as well. Danfoss has since commented that many of the targeted units were outdated legacy products and not subject to ongoing security patches.
Stephan Moelans, CEO of an influential Belgian refrigeration company, highlighted that the cyberattackers exploited the devices by directing their evaporators to enter defrost mode—a tactic seen previously in the French attacks. This assertion reinforces the notion that the same methodology is being employed across these disruptions. In Estonia, older Danfoss models were cited as being particularly vulnerable to these recent attacks, reflecting a wider trend involving aging technology unable to fend off modern threats.
Danfoss responded by urging customers to immediately sever internet connections for affected refrigeration systems and reconnect only via secure networks. While many retailers complied, some were slower to act, leaving them exposed. Security researcher Kevin Beaumont noted that all compromised freezer units had management interfaces that were accessible from the internet, signalling a significant lapse in cybersecurity hygiene. The situation is exacerbated since many of these devices are at the end of their operational life and lack available patches, highlighting the pressing need for modernisation in supermarket refrigeration tech.
In the wake of these incidents, Belgian retailers bore the brunt of disruptions. Delhaize reported substantial refrigeration challenges across numerous stores, while Carrefour encountered issues in 15 outlets—part of a larger network exceeding 700 stores. Colruyt also mentioned impacts on several of its franchises, while even IKEA experienced problems at its Mons location. The Belgian federal prosecutor has launched an investigation, reflecting the severity of the situation.
The effects were not confined to Belgium; in Ireland, SuperValu took precautionary measures to remove chilled products from 13 stores, indicating a specific model was compromised. Similarly, while Swedish grocer ICA confirmed that a handful of its outlets were affected, Coop reported disruptions at multiple locations as well. Food wastage was significant, with store managers revealing that considerable quantities of perishable goods had to be discarded.
The Netherlands also faced issues, with Danfoss estimating that at least 17 businesses suffered disruptions, particularly small grocers and butcher shops. Reports from Kesko, a Finnish retailer, echoed concerns with temperature fluctuations being noted in smaller facilities, while Italian stores operating under the Coop brand reached out to national cybersecurity authorities following disturbances. The Mosqueteiros group in Portugal similarly confirmed incidents at seven Intermarché locations, further extending the reach of these targeted attacks.
The alarming frequency of these cyberattacks has drawn strong words from EU agriculture commissioner Christophe Hansen, who expressed grave concern regarding the apparent attempt to undermine the food supply chain and erode consumer confidence. While Hansen assured the public that the EU's food security remains intact, he acknowledged the detrimental impact on businesses and the unnecessary waste resulting from these events.
Source: securityweek.com
