- Supermarket fridges and freezers in seven European countries had their thermostats remotely cranked up, in some cases to 50C (122F), which the EU condemned as "a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it".
- The Pentagon is investigating a suspected hack.
- The attack hit Belgian branches of Carrefour, Intermarché and Ikea, Coop and ICA in Sweden, Delhaize in Luxembourg, Kesko in Finland, SupaValu in Ireland, and shops in Estonia.
- The incident appeared to be a reprise of French retailers having to ditch huge amounts of food when their fridges overheated due to anonymous hackers seizing control of their internet-exposed appliance management software.
- According to Sabcobel, a Belgian refrigerator group, the impact could have been worse if they had not started patching fridges after the 12 October attack in France.
- Experts suggest state-linked actors or a lone-wolf hacker as likely explanations; Russia and China are likely suspects.
- The attack required no malware, leaving no trace, and was compared by Pilling to "wearing rubber gloves and messing with the switches".
- Commercial fridge management software is internet-connected and can be left vulnerable if patches are not installed.
- Nick Jackson of Bitdefender explained that patching can be slow because updates require offline time, and fridge operators may simply not be aware of the problem.
- In Monday’s incidents, Coop in Sweden said some fridges were linked to a 4G mobile network increasing exposure.
- In the UK, which has not yet been affected, retailers are "currently working with the National Cyber Security Centre (NSCC) to ensure their fridges and freezers are secure as possible against potential attacks".
- Internet-exposed refrigeration systems are most popular in France, Italy, Greece and Belgium, according to Forescout.
- An NCSC spokesperson said it is "working with its international partners and industry to fully understand details of an incident".
The EU has condemned a cyberattack that targeted supermarket refrigeration systems across seven European countries, including Belgium, Sweden, and Ireland, raising temperatures to 50C (122F). This incident is viewed as a deliberate attempt to disrupt the food supply chain and undermine consumer confidence.1
The attack affected major retailers such as Carrefour, Intermarché, and Coop, leading to significant food spoilage reminiscent of a previous incident in France. Rafe Pilling, senior director for threat intelligence at Sophos, noted, “The two most plausible attribution scenarios for me are some kind of state-based signalling and demonstration of capability or some kind of lone-wolf hacker.”367812
The Pentagon is currently investigating the incident, which experts believe may involve hackers linked to Russia and China. Nick Jackson from Bitdefender highlighted that the software managing these fridges is often left unpatched, making them vulnerable to attacks. He stated, “Companies might move slowly to install patches... it’s not top of their agenda.”21011
In response to the attack, the UK is collaborating with the National Cyber Security Centre to secure its refrigeration systems. Graham Wynn from the British Retail Consortium emphasized the importance of proactive measures, stating, “Retailers are currently working with the NSCC to ensure their fridges and freezers are secure.”
The incident underscores the growing threat of cyberattacks on critical infrastructure, particularly in countries with internet-exposed refrigeration systems.
“The attack hit Belgian branches of Carrefour, Intermarché and Ikea, plus Coop and ICA in Sweden, among others; no malware was used, leaving no trace of a weapon. Experts suggest state-linked actors from Russia or China are likely suspects, while the UK's NCSC is working with retailers to secure fridges.”
The Guardian
