Ing. Calogero Bono
Italy's National Cybersecurity Agency (ACN) has published a bulletin with urgent measures for large-scale retail and the cold chain, after a cyberattack hit numerous French supermarket chains. On 2 November the incidents reached Italy too, with at least four Coop stores in Sicily affected. The attackers altered the temperatures of the equipment. What matters is the weak point – control panels reachable from the Internet, a mistake that can affect any company.
A few terms before we get into the facts. IT refers to systems that handle information, such as servers and workstations. OT refers to hardware and software that control physical processes, such as compressors and sensors. SCADA is the platform that supervises multiple plants, displays alarms and sends commands. VPN is a protected connection for remote access. Jump host is a dedicated intermediate system through which you reach the machines you manage.
What happened to European supermarkets?
According to Agenda Digitale, after the attacks of 11 and 12 October on about seven hundred French businesses (figure from the Paris prosecutor's office), between 1 and 2 November similar incidents were reported in at least eight European countries. Belgium, Ireland, the Netherlands and Estonia are mentioned, in addition to Italy.
Sources do not agree on the list of countries. Punto Informatico also cites Sweden and Luxembourg. Some outlets report freezers reaching 50 °C.
What happened in Italy?
Giuseppe Spadaro, general director of the Radenza group, confirmed to ANSA IT incidents at at least four Coop stores in Sicily, with altered temperatures and spoiled food, according to Agenda Digitale. HDblog places them between Palermo and Catania and reports that the Polizia Postale is investigating.
Reports about several more shops on the island are circulating but remain to be verified. According to Open sources cited by Agenda Digitale, the ACN also received reports from a catering company in Tuscany and a frozen food producer in Emilia-Romagna.
How did they manage to alter the fridges?
According to the ACN bulletin, the attack exploited outdated installations, administration interfaces exposed to the Internet and weak authentication. It made it possible to remotely trigger defrost cycles and change plant parameters.
Agenda Digitale reports that Danfoss had already advised Dutch customers on 13 October to disconnect vulnerable devices or protect their access. Some reportedly left controllers reachable, even with default passwords. This reconstruction is based on a spokesperson quoted by the Dutch press.
What measures does the ACN call for?
The agency recommends acting immediately, prioritising the removal of exposures and the verification of operating parameters. Interventions must be coordinated between cybersecurity staff, plant managers and maintenance technicians, to avoid uncontrolled shutdowns of refrigeration.
- Inventory controllers, SCADA systems, gateways and remote assistance services.
- Remove administrative interfaces from the Internet.
- Separate OT networks from IT ones, with firewalls that deny anything not authorised. VLANs alone are not enough.
- Use VPNs with multi-factor authentication and limit supplier access.
The ACN notes that HTTPS protects communications but does not prevent exploitation of vulnerabilities or compromised credentials.
Limits to know
The authors are not known and the exact sequence of events has not been established. There is no evidence of a common coordinator across the different countries, as Agenda Digitale points out. Reports about other Sicilian stores are unverified and the figures vary between sources. Of the ACN bulletin we only read the text provided, cut off before the final recommendations.
What changes for those working with digital systems
This issue concerns any company with connected plants or devices. If you manage a shop, a warehouse or a site with remote controls, ask your maintenance provider which access points are reachable from the Internet. Check who holds the credentials and whether they are still the factory defaults. The problem echoes what we already saw with Linux server updates. For the servers you run, hosting with security updates reduces the risk of forgotten panels.
Our take
The case shows that security is not only a technical matter. As Agenda Digitale observes, installation, maintenance and software pass through different parties, and nobody governs the entire chain. Too often the search is for a single culprit, the careless technician, while ignoring that the convenience of remote control was sold without access rules. The ACN bulletin is useful, but it arrives when the damage is already done. The risk of an fragile, connected infrastructure had been known for a long time.
Frequently asked questions
What happened to Italian supermarkets?
At least four Coop stores in Sicily suffered an attack on the remote control of their frozen food cabinets. Temperatures were altered overnight and food was spoiled. The group Radenza confirmed it.
Who attacked the fridges?
It is not known. The authors are unidentified and the Polizia Postale is investigating, including whether there are international links. There is no evidence of a common coordinator behind the various incidents.
Why are the fridges connected to the Internet?
To monitor temperatures remotely, receive fault alerts and intervene without going to the store. The risk arises when the panel can be reached directly from the public network.
Is the HTTPS padlock enough to be safe?
No. According to the ACN, HTTPS protects communications but does not prevent exploitation of vulnerabilities or the use of compromised credentials. VPNs, strong authentication and updates are also needed.
What should cold chain companies do?
They should inventory connected plants and remove administrative interfaces from the Internet. Then separate OT networks from IT ones and protect remote access with VPNs and multi-factor authentication.
What to watch after the cold chain bulletin
In the coming weeks it will become clear whether the attack had a coordinator and how many Italian companies are involved. Responsibilities along the chain matter too.
- Follow updates from ACN and from plant manufacturers such as Danfoss, to know whether new guidance is issued.
- Ask your supplier in writing who is responsible for updates and remote access under the maintenance contract.
- Regularly check what in your perimeter is visible from the Internet, using inventories and configurations, before any active scanning of the plants.
