Update, Nov. 4: The attacks have reached the plasma freezers of France's national blood service through a supplier, though no products were lost, The Primary Wire reported.
Supermarkets in 11 European countries have now reported attacks on their refrigeration systems, and Italy's government held emergency security talks in response, AFP reported Tuesday. The spread shows that remote controls for store fridges and freezers left open to the internet are now a cross-border operational risk for food retailers and the firms that service them.
What Happened
AFP listed the affected countries as Belgium, Estonia, Finland, Germany, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Romania and Sweden. Germany reported four affected outlets, Romania six and Italy about 20. Across the overnight wave of Nov. 1-2, more than 100 stores saw fridges and freezers warm up, some to 50 C (122 F), SecurityWeek reported.
Belgium was hardest hit. According to SecurityWeek, Delhaize reported several dozen affected stores, Carrefour 15 of more than 700, and Colruyt five franchised Spar shops. Belgian federal prosecutors have opened an investigation. Stephan Moelans, chief executive of refrigeration installer Sabcobel, told the Belgian news agency Belga that attackers switched units into defrost mode and that a software update alone would not fix the weakness; some equipment needs physical changes.
Italian ministers met with intelligence chiefs and the National Cyber Security Agency, which issued technical advice to retailers, AFP reported. The government called the Italian impact "highly limited" and said affected outlets had outdated security, interfaces exposed to the internet and weak authentication.
In the Netherlands, Danfoss, the Danish maker of the controllers, told the broadcaster NOS that at least 17 businesses, including butchers and small shops, were hit, DutchNews reported. The systems were not on a secure network and still used a default password, even though Danfoss had advised Dutch customers Oct. 13 to take them offline.
Portugal's Mosqueteiros group confirmed incidents at seven Intermarché stores and said the attack appeared aimed at an outside firm that manages its refrigeration, Euronews reported with AFP. Coop Sweden said its affected stores ran on older 4G mobile connections, and Swedish chain ICA said all its affected stores used a Danfoss control system.
No one has claimed responsibility. Dan Cimpean, director of Romania's National Cyber Security Directorate, called the attack "semi-amateurish" and said he did not suspect a state actor, AFP reported. EU spokesman Thomas Regnier said the incidents were not isolated, and EU agriculture commissioner Christophe Hansen described them as a deliberate attempt to disrupt the food supply chain.
Why It Matters
These attacks need no sophisticated tools. Danfoss said most of the units hacked in France last month were older products it no longer updated, and security researcher Kevin Beaumont said many of the devices hit Monday are end-of-life with no patch available, SecurityWeek reported. The security firm Lupovis, in its own research cited by SecurityWeek, saw login attempts on decoy Danfoss controllers from Oct. 20-30, mostly using the factory passwords Danfoss publishes.
The exposure reaches the U.S. Internet-scanning firm Censys counted just over 1,000 Danfoss StoreView store-management interfaces reachable online worldwide, with the U.S. third behind France and Belgium, SecurityWeek reported. Separately, the Pentagon is investigating August freezer failures at military commissaries as a possible cyberattack.
Retailers, logistics firms and facilities teams should take refrigeration and building-management interfaces off the open internet, replace default passwords, identify which outside service firms can reach those systems and make sure temperature alarms reach someone overnight. Boards should ask whether that equipment appears in their cyber risk inventory at all.
Context
The wave follows October attacks that forced refrigeration units into defrost mode at hundreds of French supermarkets. French authorities later widened their alert beyond Danfoss to Copeland and Dixell controllers. Investigators have not established whether the two waves are linked, SecurityWeek reported. The Primary Wire reported the first incidents in Belgium, Luxembourg and Sweden Monday.
What to Watch
Watch the Belgian investigation and Italy's follow-up, any claim of responsibility, and whether U.S. agencies issue guidance on refrigeration controllers. A spokesperson for Belgium's Centre for Cybersecurity told Reuters, as reported by CNBC, that the attacker may never be identified.
