Hackers heat Europe's supermarket freezers to 50C in at least 11 countries, and the EU calls it an attack on the food supply
What's the deal? Hackers have remotely taken over refrigeration systems in supermarkets across at least 11 European countries, switching freezers to defrost and, in some stores, setting them to 50C. Belgium, Estonia, Finland, Germany, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Romania, Sweden and the UK have all reported incidents since 1 November, according to the BBC and AFP. Stores had to throw away chilled and frozen stock.
Who was hit? Around 40 Delhaize stores in Belgium and Luxembourg (part of Ahold DelhaizeDealroom has a profile for this one. Try Dealroom →), Belgian branches of CarrefourDealroom has a profile for this one. Try Dealroom →, Intermarché and Ikea, ICA and Coop in Sweden, Kesko's K-stores in Finland, 13 SuperValu stores in Ireland and Selver in Estonia, according to the BBC and The Guardian. Danish manufacturer DanfossDealroom has a profile for this one. Try Dealroom → told Dutch broadcaster NOS that cooling systems at at least 17 Dutch companies, mostly butchers and neighbourhood shops, were attacked overnight.
How it worked: The attackers went through internet-connected management software that lets suppliers monitor and fix fridges remotely. Stephan Moelans, CEO of SabcobelDealroom has a profile for this one. Try Dealroom →, which runs Delhaize's systems, told Belga the evaporators were flipped to defrost mode, the same method used three weeks earlier when up to 700 French grocery stores lost tens of millions of euros of food. He said some units need physical modifications, not just a software update. Coop Sweden said its affected fridges were connected over old 4G networks.
Who did it? Nobody has claimed responsibility and no ransom has been demanded. EU food commissioner Christophe Hansen called it "a deliberate attempt to disrupt our food supply chain". The European Commission, ENISA and Europol issued a joint statement urging operators to cut their exposure, Belgian federal prosecutors opened an investigation, and Italy held emergency talks with its intelligence chiefs. Romania's cyber agency called the attacks "semi-amateurish" and said it did not suspect a state actor.
The signal: Retail's cheapest connected devices are now a food-security risk. Fridge controllers were put online to save on maintenance visits, and one exposed management system was enough to empty freezers across a continent. Securing operational technology, an often-ignored corner of cybersecurity, just became a boardroom topic for grocers.
Read more: AP, BBC, AFP, ENISA
Image: REWE freezer section in Frankfurt. Credit: Alexis Jazz, CC BY 4.0, via Wikimedia Commons
