Second Wave of European Supermarket Refrigeration Attacks Raises Cold-Chain Concerns
Summary
A second wave of attacks reportedly manipulated supermarket refrigeration controllers across Europe, causing spoilage. Retailers confirmed limited impacts; authorities are investigating. Experts warn exposed, poorly secured cold-chain and other OT systems face similar.
Key points
- An unknown actor appears to have accessed supermarket refrigeration controllers and switched them to defrost mode, raising temperatures and causing food spoilage.
- The latest wave was reportedly smaller than October's attacks, which affected more than 700 stores, primarily in France; Carrefour said 15 of its 700 Belgian stores were impacted in the new wave.
- No individual or group has claimed responsibility, and European authorities are investigating.
- Researchers linked the attacks to internet-connected refrigeration controllers from Danfoss, Dixell, and Copeland. Gallagher's proposed scanning and automated exploitation scenario is a theory, not a confirmed attack method.
- Claroty researchers disclosed vulnerabilities in Danfoss AK-SM 800A and Copeland controllers; experts also cited exposed remote access, outdated firmware, default or shared credentials, and weak configurations as risks.
- Recommended protections include identifying connected assets, securing necessary remote access with a VPN and strong authentication, changing default passwords, updating firmware, and network segmentation.
Article Details
- Event Type
- Reported cyberattacks on supermarket refrigeration controllers, reportedly switching systems to defrost mode.
- Impact
- The attacks raised refrigeration temperatures to 50 degrees Celsius and caused food spoilage. Reporting described the second wave as smaller than the October attacks, which affected more than 700 retail and grocery stores, primarily in France. Carrefour said the newer attack affected 15 of its 700 stores in Belgium; BBC reporting described impacts at dozens of supermarkets across seven European countries.
MITRE ATT&CK
T1078.001 · Default AccountsGallagher's theory also included attackers pushing default credentials; the article does not confirm that this occurred.T1190 · Exploit Public-Facing ApplicationIn Gallagher's unconfirmed theory, attackers may have exploited known web vulnerabilities on exposed controllers.T1595 · Active ScanningJohn Gallagher offered a theory—not a confirmed account—that the threat actor likely scanned the public Internet for fingerprints associated with refrigeration controllers.
People
Vendors
Clarotythat attackers can exploit, like three in Danfoss' AK-SM 800A controllers that researchers at Claroty disclosed this August and another two they reported the same month in Copeland controllers. WeakCopelandrefrigeration systems had impacted 15 out of 700 stores in Belgium. In an undated statement, US-based Copeland, which manufactures technologies for regulating commercial refrigeration systems, alluded to aDanfossCERT, have linked the hacks so far to Internet-connected refrigeration controllers made by Denmark-based Danfoss, Italy-based Dixell, and Copeland. Organizations using these controllers often connect them to theDixellhacks so far to Internet-connected refrigeration controllers made by Denmark-based Danfoss, Italy-based Dixell, and Copeland. Organizations using these controllers often connect them to the Internet to enable remoteViakooGallagher, vice president at operational technology (OT) and Internet of Things (IoT) security vendor Viakoo. "While unpatched vulnerabilities exist in older firmware, they are rendered dangerous only because basic
Products
Countries
Belgiumthat impacted more than 700 retail and grocery stores primarily in France. A smaller number of stores in Belgium, Germany, the Netherlands, Portugal, Poland and Spain were also caught up in the October attacks.Estoniaattacks as impacting "dozens of supermarkets" in seven European countries including Belgium, Luxembourg, Estonia, Ireland, Sweden and Finland. Spokespersons from several supermarket chains like France's Carrefour,Finlandof supermarkets" in seven European countries including Belgium, Luxembourg, Estonia, Ireland, Sweden and Finland. Spokespersons from several supermarket chains like France's Carrefour, Belgium's Ahold Delhaize andFrancecompared to the first wave in October that impacted more than 700 retail and grocery stores primarily in France. A smaller number of stores in Belgium, Germany, the Netherlands, Portugal, Poland and Spain were alsoGermanymore than 700 retail and grocery stores primarily in France. A smaller number of stores in Belgium, Germany, the Netherlands, Portugal, Poland and Spain were also caught up in the October attacks.Irelandimpacting "dozens of supermarkets" in seven European countries including Belgium, Luxembourg, Estonia, Ireland, Sweden and Finland. Spokespersons from several supermarket chains like France's Carrefour, Belgium'sLuxembourgthe new attacks as impacting "dozens of supermarkets" in seven European countries including Belgium, Luxembourg, Estonia, Ireland, Sweden and Finland. Spokespersons from several supermarket chains like France'sNetherlands700 retail and grocery stores primarily in France. A smaller number of stores in Belgium, Germany, the Netherlands, Portugal, Poland and Spain were also caught up in the October attacks.Polandstores primarily in France. A smaller number of stores in Belgium, Germany, the Netherlands, Portugal, Poland and Spain were also caught up in the October attacks.Portugaland grocery stores primarily in France. A smaller number of stores in Belgium, Germany, the Netherlands, Portugal, Poland and Spain were also caught up in the October attacks.Spainin France. A smaller number of stores in Belgium, Germany, the Netherlands, Portugal, Poland and Spain were also caught up in the October attacks.Sweden"dozens of supermarkets" in seven European countries including Belgium, Luxembourg, Estonia, Ireland, Sweden and Finland. Spokespersons from several supermarket chains like France's Carrefour, Belgium's Ahold
Industries
Food distributiontechnology officer (CTO) at Claroty, points out that "pharmaceutical storage and distribution, food distribution centers, and industrial facilities all rely on connected operational technology to maintain preciseIndustrial facilitiesClaroty, points out that "pharmaceutical storage and distribution, food distribution centers, and industrial facilities all rely on connected operational technology to maintain precise environmental conditions."Pharmaceutical storage and distributionSean Tufts, field chief technology officer (CTO) at Claroty, points out that "pharmaceutical storage and distribution, food distribution centers, and industrial facilities all rely on connected operational technology toRetaillatest attacks were smaller in scope compared to the first wave in October that impacted more than 700 retail and grocery stores primarily in France. A smaller number of stores in Belgium, Germany, the Netherlands,