Refrigeration Disruptions Hit More Than 100 European Stores in Suspected Cyberattacks
Summary
More than 100 European stores reported refrigeration disruptions resembling attacks in France earlier in October. Retailers blamed a cyberattack, but investigators have not linked the waves; internet-exposed controllers and food losses were reported.
Key points
- More than 100 stores in several European countries reported refrigeration problems in the latest wave; reports also came from Finland, Italy and Portugal.
- Retailers attributed the disruptions to cyberattacks, but no one has claimed responsibility and investigators have not established whether the two waves are connected.
- The earlier French wave affected about 700 supermarkets, with refrigeration units reportedly forced into defrost mode, causing food spoilage and reported fires.
- Reportedly affected equipment included Danfoss, Copeland and Dixell controllers; Belgian refrigeration executive Stephan Moelans said attackers forced evaporators into defrost mode.
- Researcher Kevin Beaumont said every freezer hit on Monday had an internet-reachable management interface; many devices were end-of-life and had no available patch.
- Lupovis reported suspicious login attempts using documented factory-default credentials, but all attempts against its sensors were rejected.
- Retailers reported thrown-away food and disrupted refrigeration; the Belgian federal prosecutor's office opened an investigation.
Article Details
- Victim Organization
- Multiple European retailers and businesses, including Delhaize, Carrefour, Colruyt, IKEA, SuperValu, ICA, Coop, Kesko, and Intermarché stores
- Incident Type
- Reported cyberattacks on internet-reachable refrigeration controllers forced units into defrost mode and disrupted temperature control; the method of initial access is unknown.
- Operational Impact
- More than 100 stores in the latest wave experienced refrigeration disruptions, with some units reaching 50°C. Food was discarded, including chilled and frozen products. An earlier wave in France affected around 700 supermarkets; food was spoiled and fires were reportedly caused.
- Claim Status
- alleged
People
Christophe HansenEU agriculture commissioner who characterized the attacks as a deliberate attempt to disrupt the food supply chain and erode consumer trust, while saying food security was not then under threat.Kevin BeaumontSecurity researcher who reported that people he spoke with confirmed the affected freezers had management interfaces reachable from the internet; he also noted many devices were end-of-life and lacked an available patch.Stephan MoelansSabcobel CEO who described how the attackers forced refrigeration-unit evaporators into defrost mode and said affected equipment also required physical modification.Xavier BellekensLupovis CEO who reported suspicious login and component-fingerprinting activity against Danfoss controller sensors; he said all authentication attempts observed by the sensors were rejected.
Vendors
CopelandA day later, it expanded its alert to cover Copeland and Dixell XWEB systems.DanfossCERT-FR, the incident response team of France’s cybersecurity agency ANSSI, initially linked the compromises to Danfoss AK-SM and AK-SC series controllers.DixellA day later, it expanded its alert to cover Copeland and Dixell XWEB systems.
Products
Countries
BelgiumThe affected businesses, ranging from major chains to small butcher shops, are in Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden.EstoniaThe affected businesses, ranging from major chains to small butcher shops, are in Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden.FinlandSome units were set as high as 50°C (122°F), and problems have also been reported in Finland, Italy and Portugal.FranceThe first wave hit France overnight from October 11 to 12.IrelandThe affected businesses, ranging from major chains to small butcher shops, are in Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden.ItalySome units were set as high as 50°C (122°F), and problems have also been reported in Finland, Italy and Portugal.LuxembourgThe affected businesses, ranging from major chains to small butcher shops, are in Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden.NetherlandsThe affected businesses, ranging from major chains to small butcher shops, are in Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden.PortugalSome units were set as high as 50°C (122°F), and problems have also been reported in Finland, Italy and Portugal.SwedenThe affected businesses, ranging from major chains to small butcher shops, are in Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden.