Supermarket refrigerators and freezers across Europe have been remotely manipulated by hackers, in some cases sending temperatures soaring to 50C (122F) and forcing retailers to remove food from shelves, in an escalation that has raised fears of a new front in cyber warfare.
The European Commission has condemned what it described as “a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it”, as emergency talks were convened following a wave of incidents affecting retailers in 11 countries.
The attacks on Monday disrupted refrigeration systems in Italy, Belgium, Germany, Sweden, Portugal, Ireland, the Netherlands, Luxembourg, Finland, Estonia and the UK, according to reports.
Some supermarkets were forced to withdraw chilled and frozen products from sale or dispose of stock that had been spoiled.
The Commission held two emergency meetings on Tuesday morning with its departments, the EU Agency for Cybersecurity (ENISA), Europol, and national cyber-crisis experts. Officials sought to share information and coordinate a response to incidents that have exposed the risks posed by internet-connected equipment across the food supply chain.
Read more related news:
Britain’s food industry exposed as hackers target meat processors and supermarket systems
NCSC warns Britain has just two years to prepare for ransomware attack on critical infrastructure
Supermarkets across Europe race to remove food after hackers sabotage refrigeration
“It is important to exchange information about what happened and how we can best respond together, because this is not limited to one Member State but affects several Member States,” a Commission spokesperson said.
The disruption has prompted concern that relatively simple attacks on industrial equipment could cause significant economic and psychological damage without the sophistication normally associated with major cyber operations.
Unlike ransomware attacks, in which criminals lock down computer systems and demand payment to restore access, the refrigeration incidents have not been accompanied by demands for money. Nor has a politically motivated hacking group publicly claimed responsibility.
Rafe Pilling, senior director for threat intelligence at cybersecurity company Sophos, said two explanations appeared most plausible: a state-backed operation intended to demonstrate capability, or an individual hacker acting independently.
“The two most plausible attribution scenarios for me are some kind of state-based signalling and demonstration of capability or some kind of lone-wolf hacker that is conducting these attacks for their own personal reasons,” he said.
A state-linked operation is one possibility because of the potential impact on public confidence. Images of supermarket shelves stripped of chilled and frozen food could create anxiety well beyond the stores directly affected.
Russia and China are among the countries whose cyber capabilities could come under scrutiny, although there is currently no confirmed attribution. Western intelligence agencies have repeatedly warned that Moscow is conducting a campaign of sabotage across Europe and that such activity could intensify.
But establishing who was responsible may prove difficult. The apparent simplicity of the attacks means investigators have little conventional digital evidence to follow.
Pilling compared the method to “wearing rubber gloves and messing with the switches”. No malware was required, potentially leaving investigators without the digital equivalent of a weapon at the scene.
The vulnerabilities stem from the technology used to control commercial refrigeration. Increasing numbers of fridges, freezers and other industrial appliances are connected to the internet, allowing operators to monitor temperatures and adjust settings remotely. But those connections can also provide an entry point for attackers if systems are inadequately secured.
The problem extends beyond supermarkets. Domestic ovens, washing machines, dishwashers and central heating systems can also be connected to the internet, creating a wider range of potential targets for anyone able to exploit weaknesses in remote-access systems.
Software in industrial equipment can also remain unpatched for extended periods. Unlike computers and smartphones, which frequently alert users to security updates, machinery may continue running with known vulnerabilities because installing updates can be disruptive or technically difficult.
Nick Jackson, director of cyber-operations at Bitdefender, said installing patches could require machinery to be taken offline, creating an operational headache for retailers that need refrigeration running continuously.
But he suggested a lack of awareness could be an equally important factor. Those responsible for operating the equipment might simply “don’t think about that and it’s not top of their agenda”.
Monday’s incidents have highlighted how exposure can vary between retailers and countries. Sweden’s Coop said some of its refrigeration units were connected through a 4G mobile network, potentially increasing their exposure. ICA said its system was supplied by Danish refrigeration technology company Danfoss, which was also associated with problems during an earlier incident in France.
That earlier attack, on October 12, prompted retailers and suppliers to examine their security arrangements. Belgian refrigeration group Sabcobel said the consequences of Monday’s disruption could have been considerably worse had it not begun patching systems following the French incident.
The UK has not yet experienced the same disruption, but retailers are taking precautions. Graham Wynn, assistant director of regulatory affairs at the British Retail Consortium, said businesses were “currently working with the National Cyber Security Centre(NCSC) to ensure their fridges and freezers are as secure as possible against potential attacks”.
The NCSC said it was “working with its international partners and industry to fully understand details of an incident”.
Research by cybersecurity company Forescout suggests internet-exposed refrigeration systems are particularly common in France, Italy, Greece and Belgium, while the UK appears less exposed.
Daniel dos Santos, Forescout’s vice-president of research, said: “When we checked the data for these exposed systems online of supermarkets, the UK is not in the top 10.”
He added that the risk could not be dismissed, but said: “I wouldn’t say it’s super-high right now for the UK specifically”.
The incidents nevertheless underline the difficulty of protecting critical infrastructure when everyday equipment becomes connected to the internet. Refrigeration may appear an unlikely target for cyber criminals or hostile states, but its disruption can rapidly affect food availability, retailers’ finances and public confidence.
For supermarkets, the immediate priority is restoring secure operations and ensuring vulnerable systems are updated. For European governments, the challenge is broader: preventing weaknesses in relatively mundane technology from becoming a means of disrupting essential services.
Leave a Comment