Supermarket Refrigerator Hacking Spreads to 11 European Countries
The refrigerator hack has spread across Europe. Within about three weeks of first appearing in France, it has reached at least 11 countries.
Cases mounting from Belgium to Italy — On Tuesday (local time), supermarkets across several European countries, including Belgium, Luxembourg, Sweden, Ireland, and Italy, reportedly experienced abnormally rising temperatures in their refrigeration and freezing equipment. Refrigeration systems at multiple supermarket chains in Belgium malfunctioned overnight between Monday and early Tuesday, and the damage spread the next day to the UK, Germany, Romania, and beyond, bringing the number of affected countries to at least 11 in Europe.
The incident began in France. Between the night of the 11th and the 12th of last month, refrigeration and freezing equipment temperatures at a major retail chain rose to as high as 50 degrees Celsius, and fires broke out at some stores. France's economy and finance minister said around 700 of the country's roughly 10,000 supermarkets were affected. Intermarché and Netto stores alone accounted for some 300 locations, and the Intermarché CEO projected losses of tens of millions of euros in a single day.
Legacy remote control equipment is cited as the attack vector. France's national cybersecurity agency, ANSSI, identified older equipment from Danish company Danfoss and the US-based Copeland group as the targets of the attack. Danfoss noted that most of the affected units are legacy products no longer receiving security updates, and recommended ensuring that refrigeration control systems are not directly accessible from the internet. Richard Horne, CEO of the UK's National Cyber Security Centre (NCSC), pointed out that the affected equipment in France had been connected directly to the internet with default passwords left unchanged. The fact that many European supermarkets operate as cooperatives, with systems varying from store to store, is also cited as a vulnerability.
The EU is responding jointly to the incident. Christophe Hansen, the EU Commissioner for Agriculture and Food, characterized the attack as a deliberate attempt to disrupt the food supply chain. A European Commission spokesperson said it is discussing a coordinated response with member states.
The attackers' identity and motives remain unknown, and no group has claimed responsibility. Richard Horne, CEO of the UK's NCSC, said that given the sheer number of vulnerabilities that exist, this incident is just the beginning. He assessed that artificial intelligence (AI) did not create new attack methods; rather, long-neglected security weaknesses are being exposed on an unimaginable scale. Romania's National Cyber Security Directorate chief said the attack appeared somewhat amateurish and did not consider it likely that a state-level actor was involved.
