Ahold Delhaize, Carrefour, ICA and Coop Hit as Supermarket Fridge Attack Spreads Across Europe
Three weeks after a similar attack in France, new attacks on supermarket refrigeration warmed fridges and freezers from Sweden to Belgium, forcing stores to throw food away, Reuters reported.
New attacks on supermarket refrigeration hit Europe overnight into Monday, three weeks after a similar attack on supermarkets in France. Fridges and freezers warmed from Sweden to Belgium, forcing stores to throw food away, Reuters reported. Ahold Delhaize, Colruyt, Carrefour, ICA and Coop all had affected stores. No one has claimed responsibility.
TLDR
- Reuters reported that dozens of stores were hit. Carrefour said 15 of its 700 stores in Belgium were affected, Coop said 7 of its 800 in Sweden, and Musgrave said 13 SuperValu stores in Ireland.
- The attack follows one in France on Oct. 11 and 12, when about 700 of the country’s 10,000 supermarkets were affected, according to its finance minister.
- In the United States, the Defense Criminal Investigative Service is looking into August refrigeration failures at military commissaries, Task & Purpose reported. Fortune reported there is no proof yet that those failures were a hack, or connected to France.
- Reuters could not establish who was behind Monday’s attacks, or whether they are linked to France.
What Happened Overnight
Ahold Delhaize and Colruyt reported incidents in Belgium and Luxembourg, and ICA and Coop in Sweden, Reuters reported. IKEA said one Belgian store was affected. Musgrave pulled some chilled and frozen products from sale at its SuperValu stores. Cooling Post, a refrigeration trade publication, also listed reports from the Netherlands and Estonia.
A sales manager at an ICA franchise store in Stockholm told Reuters the attack came at 2 a.m. and was noticed hours later. The manager said all of the store’s freezers reached 50 degrees Celsius (122 degrees Fahrenheit). ICA has confirmed only that a limited number of stores were affected by an overnight incident. Coop called it a cyber incident involving unauthorized tampering with its refrigeration systems.
Readings varied by store. RetailDetail reported about 15 degrees Celsius at Delhaize, citing RTL Info. The owner of Belgian butchery chain De Laet & Van Haver found fridges as high as 18 degrees and estimated about €15,000 ($16,800) worth of meat was ruined, Reuters reported. A Proxy Delhaize in Hoepertingen put its discarded food at a minimum of €60,000, VRT reported.
How the Attack Works
Stephan Moelans, chief executive of Sabcobel, which operates the systems used by Delhaize and other chains, told Belga that a cyberattack switched units’ evaporators into defrost mode, CBS News reported. Freezers carry electric defrost elements to stay free of ice. Kiran Cluckers of Airclima.be told VRT that running those elements and the fans with the cooling off can easily reach 30 or 40 degrees Celsius.
Reuters reported that at least some of the units hit Monday used temperature controls from Danfoss, whose technology was also targeted in France. Coop said Danfoss is among its suppliers. Danfoss said it has been working with customers on fixes. In October it said most units hit in France were legacy products or current products on outdated firmware, and that it has long advised customers to update and migrate, Cooling Post reported.
In its alert on the French attack, CERT-FR, France’s government cybersecurity response team, named Danfoss AK-SM and AK-SC controllers plus Copeland and Dixell xweb units. It warned that attack campaigns were probably still under way. Moelans said many units will need physical modifications, which he said requires investment.
Where the Food Safety Line Sits
Hélène Bonte of FAVV, Belgium’s food chain safety agency, told VRT that the general maximum is 7 degrees Celsius, and can be 4 degrees for sensitive products such as meat and fish. Stores may not sell products that have become too warm. Frozen products must not go above minus 18 degrees at the core.
The U.S. Angle
Reports so far on Monday’s incidents describe stores in Europe. Ahold Delhaize also owns Stop & Shop, Food Lion and Giant in the United States. It reported a cybersecurity incident to Dutch police in October, CBS News reported. No report so far links that incident to the refrigeration attacks.
The Defense Criminal Investigative Service is leading a joint investigation into refrigeration failures at military commissaries in August, Task & Purpose reported. At least six were affected, and at Fort Huachuca in Arizona every commissary freezer entered defrost mode overnight. The Pentagon has not publicly confirmed that hackers were responsible. Fortune reported Sunday that there is no proof yet that the failures were a hack, or connected to the French attack.
Cyber insurer Coalition told The Register that on Oct. 15 it counted 618 Danfoss devices still connected to the internet, 50 of them in the United States. The Register cautioned that an exposed controller is not necessarily a vulnerable one.
Why It Matters
Cold storage now runs on software, and a controller can stay in service long after its security updates stop. EU agriculture commissioner Christophe Hansen called the attacks a deliberate attempt to disrupt the food supply chain and undermine consumer confidence, Reuters reported.
Who is responsible remains open. A spokesperson for Belgium’s Centre for Cybersecurity told Reuters it may never be determined. For grocers, the next question is how many controllers stay reachable from the internet.
Sources: Reuters, CBS News, VRT NWS, RetailDetail, Cooling Post, Cooling Post on Danfoss, Associated Press, CERT-FR, Task & Purpose, Fortune, The Register, The Hacker News.