Another Wave of Refrigerator Cyberattacks Sweeps European Grocery Stores, Causing More Food Losses
Need to Know
- A new wave of cyberattacks targeting internet-connected supermarket refrigeration systems affected food retailers across several European countries on November 2, following similar attacks in France
- Affected retailers included Ahold Delhaize, Carrefour, SPAR, ICA, Coop, and SuperValu, among others, with some reporting more than a dozen impacted locations
- Hackers reportedly exploited vulnerabilities in refrigeration software to raise freezer temperatures overnight, causing spoilage and food losses; a responsible party has not yet been identified
- Similar refrigerator malfunctions at U.S. military commissaries are also under investigation as possible cyberattacks
- Cybersecurity experts advised retailers to identify connected assets, eliminate direct internet exposure, update vulnerable software, and implement safeguards that verify equipment commands and prevent unsafe temperature changes
Less than a month after a targeted refrigerator cyberattack swept hundreds of grocery stores in France, resulting in mass food losses, another similar incident has impacted additional food retailers across Europe.
Additionally, on Friday, it was reported that the U.S. Pentagon is also investigating whether a series of refrigerator malfunctions similar to those in Europe, which occurred at American military base commissaries in August, could have been the result of targeted cyberattacks.
As was seen in France, internet-connected refrigeration systems at supermarkets were infiltrated by hackers and temperatures were raised to as high as 50 °C overnight. The latest wave of attacks was discovered on the morning of Monday, November 2.
This time, affected retailers included Ahold Delhaize, SPAR, Colruyt, Carrefour, Shop&Go, ICA, Coop, De Laet & Van Haver, SuperValu, and Selver in Belgium, Luxembourg, Sweden, Ireland, and Estonia, per Reuters and NBC News. Even one IKEA cafeteria was impacted.
The exact number of stores hit by the attack has not yet been reported by all retailers, but some companies shared that more than a dozen of their locations had been affected, including Ahold Delhaize, Carrefour, and SuperValu.
Some of the refrigerators targeted in the latest wave of attacks ran on the same outdated Danfoss software exploited in the French cyberattacks. Additionally, according to the Estonian outlet ERR, refrigeration technology supplier Kitman Coldtech reported that one of its client stores was attacked, but that other clients with different refrigeration systems were also hit.
The EU Commissioner for Agriculture Christophe Hansen called the attacks “a deliberate attempt to disrupt [Europe’s] food supply chain” and said their repeated occurrence is “deeply concerning.”
Looking for quick answers on food safety topics?
Try Ask FSM, our new smart AI search tool.
Ask FSM →
A responsible party has not yet been identified in connection with any of the refrigerator cyberattacks.
"It is not known who is behind this attack, and it may never be determined," Katrien Eggers, spokesperson for Belgium's Center for Cybersecurity, told Reuters. She added that artificial intelligence (AI) can now be used to successfully exploit weaknesses in information technology (IT) systems.
Sweden’s National Cybersecurity Center is investigating the cyberattacks.
How Can Retailers Protect Themselves Against Fridge Cyberattacks?
Cybersecurity expert Patrick Lamplmair, CTO and Co-Founder of Tributech, explained to Food Safety Magazine steps that retailers should take to protect their operations in light of the recent pattern of cyberattacks on refrigeration systems.
“The first steps are basic,” said Mr. Lamplmair. “Know which assets are connected, remove direct internet exposure, and patch. But patching will always lag behind attackers. The lasting fix is to stop trusting the network and verify at the asset itself. Each command should prove its origin and that it was not altered, and each setpoint should be checked against physical limits before it runs. A freezer should never accept an instruction to heat to 50 °C, no matter who sends it.”
He continued, “This must be designed in from the start, not added later. Under the EU Cyber Resilience Act, manufacturers of connected products are becoming legally responsible for exactly this. Operators should ask their suppliers now how commands to their equipment are verified.”
Incident Highlights Cybersecurity as a Food Safety Issue
These cyberattacks highlight cybersecurity as an emerging and important food safety issue—a topic explored in ongoing Food Safety Magazine cybersecurity columns.
In an early entry from June 2022, authors Robert Norton, Ph.D., Auburn University Professor and National Security Liaison, and N.C. Simmons, a National Security Specialist, wrote:
“Cyber is the backbone for food and agriculture defense. Adversaries have the means, opportunity, and motivation to break the cyber backbone at will. Just because they have not done so, does not mean they will not in the future. If or when adversaries carry out an attack of large magnitude, the result could be a massive compromise of food safety, food defense, and food security. To avoid that dark scenario, agriculture and food companies must properly prepare for a different kind of assault. The place to start is with their own cyber defense systems.”
