Published in Industry Insights
Suspected Cyberattacks Are Heating Europe's Supermarket Freezers. The Weak Link Is Old Controllers
Two waves of suspected cyberattacks in October and November raised temperatures in supermarket freezers across Europe, and our view is that for anyone selling or buying frozen meat the lesson is about who controls the temperature, and how you would know.
Martina Osmak
Director of Marketing
MeatBorsa's take
This section is our own reading of the news. The confirmed facts follow further down, and we mark clearly which is which.
The story is not about freezers. It is about the small computer that tells the freezer what to do. In the cases reported so far, the machines themselves worked as designed. What changed was the setting: defrost modes switched on, temperatures set as high as 50°C. A freezer that has been told to defrost looks normal from the outside, and the product inside can be compromised long before anyone opens the door.
That matters to every buyer of frozen meat, including those who buy for retail. The stores and sites hit were the places where meat and other frozen food end up. Our reading is that the cold chain has always depended on a number on a screen, and these incidents show how much trust sits behind that number.
The vendors and the experts quoted all point to the same weakness: older, remotely managed controllers that could be reached from the internet.
Questions a buyer or seller may want to put to a cold store, carrier or retail partner: which controller and gateway models run the cold rooms and trucks, are their management interfaces reachable from the internet, is the temperature record kept on a logger that is separate from the control system, is there a manual fallback if remote control fails, and how quickly would the site know if a setting changed overnight.
What we assume, and why we could be wrong
We assume the exposed equipment is mostly older, remotely managed units, as the vendors say. If newer systems turn out to be affected too, the exposed base is larger than we think.
We assume buyers will pay more attention to temperature records and who controls them. We could be wrong if the incidents stop and attention fades.
What the reports say
Two waves have been reported in under a month. Reuters, AP and ABC News are our sources for what follows, and we have kept to what they confirm.
France, from mid-October
The French finance minister, Roland Lescure, told parliament that about 700 of the country's 10,000 supermarkets were affected, according to AP on 29 October. He said food supplies were not at risk but called the attack a threat to food security. BFM-TV reported that attackers forced continuous defrost cycles and set temperatures as high as 50°C. The Paris prosecutor's cybercrime unit is investigating, including the spoiled food and reported fires.
France's national cybersecurity agency reported "numerous compromises" of remote control modules made by Danfoss of Denmark and Copeland of the United States. Danfoss said most affected units were older products that no longer receive updates. Copeland said the flaw was in a controller generation that has reached end of life. AP also reports that in August the security firm Claroty had flagged vulnerabilities in a Danfoss and a Copeland platform, including controllers reachable from the public internet, and that the companies have since fixed them.
A university researcher quoted by AP noted that there was no ransom demand and no data theft, which makes the case unusual.
Belgium, Sweden, Ireland, Estonia and others, 1 to 2 November
Reuters reports that overnight on Sunday 1 November, refrigeration systems were affected in Belgium, Estonia, Ireland, Luxembourg and Sweden. ABC News adds the Netherlands. The Belgian refrigeration contractor Sabcobel said the units' evaporators were switched to defrost mode. In Estonia, the supplier Kitman Coldtech said temperatures were set to 50°C.
The reported scale is small per chain, but wide across countries:
Ireland: 13 of SuperValu's 223 stores, linked to one refrigeration model.
Belgium: 15 of Carrefour's 700 stores, according to ABC News, plus dozens of Delhaize stores, which described an "IT incident".
Sweden: six or seven of Coop's more than 800 stores, depending on the report, and a "limited number" of ICA stores. Axfood said freezers at a home-delivery distribution centre near Gothenburg were hacked.
Netherlands: 17 facilities using Danfoss systems, including frozen storage and butcher shops, according to Dutch broadcaster NOS as cited by ABC News.
No one has claimed responsibility for either wave. The head of Sweden's national cybersecurity centre said there are "quite a lot of exposed operational technology devices" in Sweden that need updating or patching. A European Commission spokesperson said the incidents show that cyberattacks can disrupt services and directly affect citizens' daily lives. ABC News, citing Reuters, also reports similar refrigeration incidents at several US military commissaries in August, which the Pentagon is investigating.
No source we found gives a figure for the amount of food lost.
Sources
Freezers in Sweden, Belgium overheat following possible cyberattacks - Al Jazeera (Reuters)
European grocery chains' freezers, refrigerators targeted in apparent cyberattacks - ABC News