Supermarket fridges and freezers across seven European countries have experienced significant malfunctions, with some thermostats reportedly set to 50 degrees Celsius (122 degrees Fahrenheit). The European Union has condemned the incidents as a “deliberate attempt to disrupt our food supply chain and undermine consumer confidence.”
Affected Supermarkets and Background
The disruptions struck various retailers, including Carrefour, Intermarché, and Ikea in Belgium, Coop and ICA in Sweden, Delhaize in Luxembourg, Kesko in Finland, SuperValu in Ireland, and stores in Estonia. This wave of incidents appears to mirror a hacking event from three weeks prior, where French supermarket chains were forced to discard substantial quantities of food due to sudden overheating caused by unauthorized access to their management software.
A similar incident in the U.S. occurred in August, affecting commissaries at at least six military bases, prompting Pentagon investigations into a suspected hack.
Experts suggest these attacks may indicate a new method in cybercrime, as the controls of various appliances, including ovens and washing machines, are increasingly connected to the internet, creating potential vulnerabilities.
Investigation and Attribution
There have been no claims of responsibility from politically motivated hacktivist groups or ransomware gangs, as the damage inflicted on the supermarket systems is already realized by the time the attack occurs. Rafe Pilling, senior director for threat intelligence at Sophos, indicated that the perpetrators could either be state-sponsored actors demonstrating capability or individual hackers targeting these systems for personal reasons.
The state involvement theory seems plausible due to the psychological impact such disruptions have on populations. While North Korea has been implicated in recent cyber activities, attention is also drawn to potential connections with Russian and Chinese hackers. Western intelligence officials have previously warned that Moscow is engaged in a campaign of sabotage across Europe that is likely to escalate.
The relative simplicity of these attacks complicates attribution; they do not require malware, making it difficult to trace the intrusions. Pilling compared such hacks to “wearing rubber gloves and messing with the switches.”
Vulnerabilities and Security Measures
The management software for commercial fridges remains open to hacking due to limited updates and patches, which may not be prioritized by businesses. Nick Jackson, a cyber-operations director at Bitdefender, suggested that the slow installation of patches could stem from the potential downtime required, which is particularly challenging for food retailers.
In the recent incidents, Coop in Sweden noted that some fridges were linked to a 4G mobile network, increasing their vulnerability, while ICA’s systems were supplied by Danfoss, a company previously involved in related breaches.
Defensive Strategies and Current Risk Analysis
One effective countermeasure is to update software systems regularly. According to the Belgian refrigerator group Sabcobel, the impact of the latest hack was mitigated by proactive patches following the earlier attacks in France. Meanwhile, retailers in the UK are collaborating with the National Cyber Security Centre (NCSC) to enhance the security of their refrigeration systems.
As of now, British supermarkets have not reported similar hacks, partly because internet-exposed refrigeration systems are less common in the UK compared to countries like France, Italy, and Belgium, according to the cybersecurity firm Forescout. The NCSC stated it is actively working with international partners to comprehend the unfolding situation.
