Ing. Calogero Bono
On the night between Sunday and Monday, 2 November, attackers remotely changed the settings of refrigeration controllers in supermarkets in Belgium, Sweden, Estonia and other European countries. Fridges and freezers heated up, and some stores threw away or pulled fresh and frozen food. Danfoss, the Danish company that makes these controllers, says its products were involved, as they were three weeks earlier in France. It matters because it shows how costly it is to leave old, poorly protected devices online.
A few terms before we get into the facts. Refrigeration controller is the computer that runs a store's fridges and freezers and can be connected to the Internet for remote maintenance. Defrost is the mode used to remove ice, but in these attacks it was used to heat the units. Firmware is the device's internal software, which needs to be kept up to date. VPN is a protected connection for accessing a network from outside. CERT-FR is the French national cybersecurity agency's unit.
What happened in European supermarkets?
According to The Hacker News, no chain has declared more than a few dozen stores affected. In Belgium the units were put into defrost, as Stephan Moelans, director of Sabcobel, said. Elsewhere the temperature was raised. An ICA store in Sjöbo, Sweden, reported fridges and freezers taken to 50 °C.
According to BleepingComputer, more than 115 stores were hit across Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia. It is not clear whether the attack was coordinated or aimed at individual outlets.
Which chains say they were hit?
Each described the episode in its own way, and not all of them speak of a cyberattack. Delhaize cited a "cyber incident" in a few dozen stores. Carrefour Belgium counted 15 stores out of 700, with very limited impact. Coop Sweden counted 7 out of over 800, while Musgrave, owner of SuperValu, reported 13 out of 223.
According to the AFP agency, cited by The Hacker News, at least four Coop supermarkets run by the Radenza group in Sicily were hit through the remote control system for frozen food sections. DDay.it also reports a pattern similar to the French one from mid-October. In Hove a butcher estimated about 15,000 euros of ruined meat.
How did the attackers get in?
The sources do not give a complete technical account. A Danfoss spokesperson told Dutch broadcaster NOS that the systems hit in the Netherlands were not on a secure network and still used default passwords. Danfoss added that the weakness lies mainly in outdated software.
In Estonia, according to Jann Mutso of Kitman Coldtech, the control computer of an old Danfoss system was reached. In Belgium, Moelans said, the attackers entered the systems of individual supermarkets and not those of the installers. Sabcobel had advised protecting the connection, but not everyone had done so. The story recalls what was already written about the first wave of attacks on refrigerators.
What can equipment managers do?
The most detailed reference remains the October alert from CERT-FR, which covers Danfoss AK-SM and AK-SC controllers, Copeland xweb and Dixell xweb. For devices that were not compromised, it lists a few steps.
- Make the devices unreachable from the Internet.
- Check the configuration, especially defrost schedules.
- Restore access only through a VPN or protected network.
- Update the firmware, set the security level to Strict and change default passwords.
For end-of-life devices, which no longer receive fixes, CERT-FR says they very likely remain exposed even after a reset. For a broader picture, see the analysis of who manages connected equipment.
Limits to know
No one had claimed the attacks by Monday evening, and it is not known whether they are linked to the French one. A similar method does not prove the attackers are the same. The Belgian Centre for Cybersecurity said those responsible may never be identified. The manufacturer is not named in every case, and as of 3 November Danfoss had not published a notice on its website.
What changes for those working with digital systems
If you manage stores, warehouses or businesses with connected equipment, make a list of what is linked to the Internet and ask whether it really needs to be. Ask the technician who services your equipment how remote access works and whether a VPN is used. Check for default passwords and how old the devices are. Also review your insurance contract before cutting the data flow to the maintenance provider, as CERT-FR points out. If you run servers or management software, the logic is the same – updates and protected access, as with hosting with security updates.
Our take
The weak point is not sophisticated. Default passwords, outdated software and exposed access are well-known problems, and the first French wave had already given the warning. Those who acted limited the damage; those who did not threw away stock. Calling it a "cyber incident" without explaining the cause does not help other operators. What is needed are clearer warnings from manufacturers and a moral obligation to replace devices that no longer receive updates.
Frequently asked questions
Which brands were hit?
Danfoss says its products were involved. A Belgian butcher told NOS that a Copeland unit was also attacked, without giving a clear answer. In other cases the manufacturer was not named.
Who attacked the supermarkets?
It is not known. No one has claimed the attacks from Monday evening. In Belgium the federal prosecutor has opened a criminal investigation.
Is Italy involved too?
Yes, according to AFP as cited by The Hacker News. At least four Coop stores run by the Radenza group in Sicily were hit through remote control of their frozen food sections.
Is updating the software enough?
Not always. Moelans of Sabcobel says an update alone is not enough, because physical changes that cost money are also needed. The simplest solution is a protected Internet connection.
What should be done with old devices?
Take them off the Internet or replace them. CERT-FR warns that end-of-life devices without fixes are very likely compromised if they stay online. A factory reset alone is not enough.
What to watch for in the coming weeks on connected equipment
Investigations and manufacturer notices will show whether there is a link with France. In the meantime, it is worth keeping an eye on a few signals.
- Check whether Danfoss publishes an official notice on its channels.
- Follow updates from CERT-FR and national cybersecurity centres.
- Ask your maintenance provider for a replacement plan for devices that no longer receive updates.
Sources
- thehackernews.com, New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food
- bleepingcomputer.com, Hackers disrupt refrigeration systems at European supermarkets
- dday.it, Nuovi attacchi informatici ai frigo europei – dopo la Francia, sbrinati impianti in Belgio, Svezia ed Estonia
