Newsletter

• Approximately 700 out of 10,000 supermarkets in France were affected in October, and on Monday, nine more countries reported issues with refrigerators/cold storage equipment.
• France CERT-FR has linked these intrusions to the remote controllers of Danfoss (Danfoss) and Copeland. As of now, no organization has claimed responsibility for them.
• The Italian government had originally scheduled a cybersecurity meeting for Tuesday, but CERT-FR warned that these attack activities are likely to be ongoing.

It seems that the freezing equipment in Europe has "got out of control." On Monday night, supermarkets in nine countries reported malfunctions with their cooling systems, resulting in increased temperatures.

Stores in Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal, and Sweden have all reported issues, with the equipment temperature in Estonia reaching as high as 50°C (122°F).

At present, no organization has claimed responsibility for this, so it seems that the only "highlighted" elements are these freezing devices.

The "patient zero" of this incident is in France. French Finance Minister Roland Lescure stated on October 13th in parliament that about 700 out of the country's 10,000 supermarkets were affected.

According to French CERT-FR, hackers forced devices to enter a continuous defrosting cycle, causing food to spoil and triggering fires in some stores. CERT-FR stated that there have been multiple incidents where remote control modules produced by Danfoss and Copeland have been compromised.

According to statistics from Groupement Mousquetaires, which owns Intermarch é and Netto, 300 of its stores were affected; Cooperative U reported that 80 out of its 2,000 stores were impacted. Lescure stated that there was no risk to food supply, but also acknowledged that this attack "hit at the core of our food safety." As of Tuesday, some of the display cabinets under Mousquetaires were still not in use.

This incident on Monday affected multiple chain brands. In Belgium, Carrefour stated that around 15 out of its approximately 700 stores were disrupted. Belgian refrigeration contractor Sabcobel reported that the evaporators were switched to defrost mode, and a federal prosecutor has launched an investigation. Four Delhaize stores in Luxembourg also reported issues.

In Italy, Radenza Group, which operates Coop brand stores on the island of Sicily, stated that the attack occurred at 4 a.m. local time, targeting the remote control system of the frozen food area. In Ireland, Musgrave reported that 13 of its SuperValu stores were affected, while in Portugal, Mosqueteiros confirmed that related incidents occurred at 7 of its Intermarch stores.

When the temperature reaches 50°C (122°F), the freezer has already far exceeded the temperature of a hot tub, and essentially becomes a low-power steam generator. Even worse, if food is left in there for too long, it can become a breeding ground for bacteria to multiply rapidly.

In Sweden, Coop stated that about 6 out of its approximately 800 stores were affected, as these stores use 4G connectivity and are therefore "more vulnerable to risks." Ica mentioned that a few stores encountered issues, and the affected stores used external Danfoss control systems. Neither company has confirmed that this was a cyberattack, while Kesko from Finland indicated that the possibility of network interference cannot be ruled out either.

The EU Commissioner for Agriculture, Christophe Hansen, described these incidents as attempts at "deliberate sabotage" of the food supply chain. Investigators have not yet clarified whether this wave of incidents on Monday is related to the attacks in France.

Estonian refrigeration company Kitman Coldtech stated that the affected devices are older models of the Danfoss type, similar to those that were attacked in France. CERT-FR warns that exposing devices that have been discontinued and for which no security patches are available to the internet poses a very high risk of intrusion. Researchers disclosed vulnerabilities in the Danfoss AK - SM 800A controllers in August, which include authentication bypasses.

Claroty It has been discovered that 2,765 devices of this type are exposed online, and Danfoss has already fixed these vulnerabilities in firmware R4.3.1. It is not yet clear which weakness attackers are exploiting. CERT-FR indicates that these attack activities are likely to be ongoing, while the Italian government had scheduled a cybersecurity meeting for Tuesday.

At present, CERT-FR recommends that operators remove these controllers from the public internet. The CEO of Sabcobel stated that many old devices require physical modifications, which incur financial costs. Until these modifications are completed, there is actually no real solution for these old devices. This also means that that 1998 model horizontal freezer in your home might be one of the safest devices on the European continent.