New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food

Attackers remotely changed the settings on refrigeration controls at supermarkets in Belgium, Sweden, Estonia and other European countries overnight into Monday, November 2, warming fridges and freezers. No chain reported more than several dozen affected stores, and some had to throw away chilled and frozen food or take it off the shelf. Danfoss, a Danish maker of refrigeration controls, said its products were involved, as they were three weeks earlier when attackers hit hundreds of French supermarkets. No one had claimed the attacks by Monday night, and it was not known whether they were linked to the attack in France. Refrigeration controls are computers that run a store's fridges and freezers. They can be connected to the internet, allowing refrigeration contractors to monitor them and fix faults remotely. In Belgium, attackers switched cooling units into defrost mode, Stephan Moelans, chief executive of the refrigeration contractor Sabcobel, told Belgian media. Defrost mode is meant to clear ice, but in these attacks it made the units heat up instead of keeping food cold. Sabcobel manages refrigeration systems for the Delhaize supermarket chain. In other cases, the temperature setting was raised. An ICA store in Sjöbo, in southern Sweden, said its fridges and freezers had been set to 50°C and that staff were throwing out the affected goods. At a Selver supermarket in Estonia, a freezer was set to 50°C, said Jann Mutso, chief executive of the refrigeration supplier Kitman Coldtech. Its temperature rose by only about 2-3°C, and the problem was resolved within about 10 minutes, with no products damaged. Danfoss's security advisories page listed no advisory about the attacks when The Hacker News checked on November 3. The most detailed steps for operators are still those in an October alert from CERT-FR, part of France's national cybersecurity agency. Which Companies Say They Were Hit Each company described the incident in its own words, and not all of them called it a cyberattack. Country Company Stores affected What the company or its supplier said Belgium, Luxembourg Delhaize Several dozen, mostly in Belgium and a few in Luxembourg An "IT incident" affected refrigeration. The range of fresh and frozen food was temporarily limited. Belgium Carrefour 15 of more than 700 A cyberattack on its refrigeration, with very limited impact. Belgium Intermarché 10 to 15 Problems with its fridges. Belgium Spar, under Colruyt Group 5, run by independent owners Their fridge systems were attacked. Belgium IKEA 1, in Mons A cyber incident hit the store's fridges and freezers. No other IKEA store in Belgium was affected. Sweden ICA A limited number. No count given An incident affected refrigeration and freezer systems. ICA did not confirm a cyberattack. Sweden Coop 6 (to TT and AFP) or 7 (to Reuters and Bloomberg), of about 800 A cyber incident in which someone tampered with its refrigeration without permission. Ireland Musgrave, owner of SuperValu 13 of 223 A "cyber incident" limited to one refrigeration model. Estonia Selver, through supplier Kitman Coldtech 1 An attack on an older Danfoss system. Netherlands Businesses not named At least 17 businesses, including butchers and small local shops Attacked, according to Danfoss. Finland Kesko A few smaller stores Unusual temperatures. The cause was under investigation. The stores' equipment is outside Kesko's central protections. Portugal Intermarché, Mosqueteiros group 7 A cyberattack that appears to have targeted an outside company managing the refrigeration, according to AFP. Italy Coop supermarkets run by Radenza Group At least 4, in Sicily An attack on its remote control system for frozen food sections, according to AFP. At a De Laet & Van Haver butcher shop in Hove, south of Antwerp, the fridges were turned up as high as 18°C, owner Luc De Laet told Reuters. He estimated that about €15,000 worth of meat was ruined. At the 13 SuperValu stores, Musgrave took chilled and frozen products off sale as a precaution. The company said on Monday afternoon that the incident had been resolved and restocking was under way. What Companies Say About the Equipment and the Way In Several of the systems that were hit were made by Danfoss. All of ICA's affected stores were connected to an outside refrigeration control system supplied by Danfoss, an ICA spokesperson told AFP. In Estonia, attackers reached the control computer of an older Danfoss system, Mutso said. Danfoss is not named in every case. Musgrave's statement did not name the maker of the affected model. An affected Belgian butcher told Dutch broadcaster NOS that equipment from a second maker, Copeland, was also attacked in Belgium. Copeland gave NOS no clear answer to questions about the attacks. The Dutch systems that were hit were not on a secure network and still used default passwords, a Danfoss spokesperson told NOS. Most shops there had taken measures after the French attack, but a few had not, and those were the ones hit. Danfoss also told Belgian broadcaster VTM that the weakness lies mainly in outdated software and that customers who had not updated were affected, Euronews reported. Sabcobel knows of about 20 affected units among the hundreds it manages in Belgium. In the Belgian cases, attackers got into individual supermarkets' systems, not those of refrigeration contractors, Moelans told Belgian media. Sabcobel had advised stores to secure their internet connections, and many but not all had done so. Mutso said old controllers that had not been updated were being targeted. Selver said the store that was hit was the last one it had not yet moved to a new system. ICA told NBC News that its own systems were not affected and that the affected stores used an outside supplier and were connected to a network outside ICA's central network. Belgium's Centre for Cybersecurity told reporters on Monday that it had no further information. Sweden's National Cybersecurity Centre did not say in its notice how attackers got in. What Operators Can Do CERT-FR's alert covers Danfoss AK-SM and AK-SC series controllers, as well as Copeland xweb and Dixell xweb. It says attack campaigns against these devices are probably still underway. When The Hacker News checked on November 3, the alert had last been updated on October 16. For devices that have not been compromised, the steps are: Make sure the devices cannot be reached from the internet, including any device on a public IP address. Check your insurance contract before cutting the data feed to your refrigeration contractor. Check the whole configuration, especially the defrost schedules. Restore access only through a secure VPN or a protected network. In an emergency, you can filter the contractors' IP addresses at a firewall, but this should not be a lasting fix. Follow the maker's good practices, such as updating firmware. For Danfoss devices, set the security level to Strict and make sure default passwords have been changed. For a device that has been compromised, two more steps follow: restart the Danfoss device or reset it to factory settings, then reconfigure it before putting it back into service. End-of-life devices that no longer get security fixes are very likely to be compromised if they stay on the internet, CERT-FR warns. A factory reset alone leaves them open to attack again. In October, Danfoss said most of the units hit in France were older models it no longer updates, the AK-SM 800 and AK-SC 355. Danfoss advised Dutch customers on October 13 to disconnect their systems from the internet and reconnect them only through a secure network. It had also been working with customers to put fixes in place. Sweden's National Cybersecurity Center advised organizations to list which devices are connected to the internet, decide whether each one needs to be connected, and keep any that remain connected updated and protected with multiple layers of security. Moelans said a software update alone is not enough, because the installations need physical changes that cost money. The simplest answer is a secure internet connection for managing the fridges, which most of Sabcobel's customers adopted after the French attack. Who Is Behind It Danfoss said the Dutch attacks were the same kind as the one in France, Sabcobel said the same method was used in Belgium, and Kitman said the method in Estonia was similar. A shared method does not show that the same people carried out both attacks. Belgium's Centre for Cybersecurity said on Monday that it was not known who was behind the attacks and that "it may never be determined". Belgium's federal prosecutor's office has opened a criminal investigation, it confirmed to VRT. Sweden's National Cybersecurity Centre said on Monday that it was following the incidents and sharing information with agencies in other Nordic and European countries. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.