Supermarket refrigerators and freezers in seven European countries reportedly failed after their thermostats were changed remotely, in some cases to temperatures as high as 50°C. The European Union condemned the incidents, describing them as an attempt to disrupt food supplies and undermine consumer confidence. No group has claimed responsibility so far.
The latest reported incidents took place on Monday and affected stores in countries including Portugal. They follow an October 12 incident in France, when hackers reportedly took control of refrigeration-management software used by several supermarket chains. Retailers had to discard large quantities of food.
The software controlling commercial refrigeration systems is connected to the internet and can remain unpatched for long periods. Unlike computers and smartphones, these systems may not routinely prompt users to install security updates. Nick Jackson, Bitdefender’s director of cyber operations, said applying patches can require taking equipment offline, creating difficulties for food retailers. A lack of awareness or prioritisation may also leave systems exposed.
Swedish retailer Coop said some of its refrigeration units were connected through a 4G mobile network, increasing their exposure. ICA said its system is supplied by Danish company Danfoss, which also experienced problems in France.
Rafe Pilling, Sophos’s senior director of threat intelligence, identified two plausible explanations: a state-backed operation intended to demonstrate capability, or an individual hacker acting for personal reasons. The source article says a state-linked operation appears more likely, but no evidence identifying those responsible has been reported. The simplicity of the reported method, which involved changing settings without malware or a technical trace, could make attribution difficult.
A similar suspected incident was reported in the United States in early August, when refrigerator failures affected supermarkets at at least six military bases. The Pentagon is investigating it as a possible cyberattack.
Keeping refrigeration software up to date is one way retailers can reduce the risk. Belgian refrigeration group Sabcobel said the effects of Monday’s incident would have been worse had it not begun applying patches after the October attack in France.
Sources: Pplware.