Skip to content
securitytabs

LiveUpdated

Second wave of attacks tampers with supermarket refrigeration across Europe

Attackers appear to have remotely changed refrigeration settings at supermarkets in several European countries, warming fridges and freezers and spoiling food. Affected stores had to pull stock; no action list has been published in the coverage reviewed.

Remote tampering with supermarket refrigeration in Europe
Remote tampering with supermarket refrigeration in Europe

What's new

Newest coverage

TimelineWhat should my organization do?

What happened

Supermarket and grocery store refrigerators across Europe appear to have been hacked early Monday, the second such incident in recent weeks in which attackers manipulated temperature controls and caused stock to spoil, The Record reports. [1]

The Hacker News reports that attackers remotely changed settings on refrigeration controls at supermarkets in Belgium, Sweden, Estonia and other European countries overnight into Monday, November 2. No chain reported more than several dozen affected stores, and some had to throw away chilled and frozen food or take it off the shelf. [2]

Earlier incident

Infosecurity Magazine says the incident is reminiscent of an attack that affected French retailers last month. It describes the temperature changes as reported and not confirmed. [3]

What is not yet known

The coverage reviewed does not identify the attackers, the method used or any vulnerability. The Hacker News excerpt mentions Danfoss, a Danish maker of refrigeration controls, but the available text does not say what the company stated. [2][1]

Timeline

  1. Some affected chains were reported to have thrown away or pulled chilled and frozen food. [2]

  2. Supermarket refrigerators across Europe appeared to have been hacked, in the second such incident in recent weeks. [1]

  3. Refrigeration controls at supermarkets in several European countries were remotely changed overnight into Monday. [2]

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

Shops with networked refrigeration may be exposed, but no cause, vulnerability or fix has been published in the coverage reviewed. [1][2]

What to do

  1. Ask your refrigeration or facilities provider whether your controls are reachable from the internet and whether they saw unusual setting changes. [2]
  2. Check temperature logs and alarms for unexpected changes. [2]

Mid-size company

A small IT or security team

What to know

Attackers changed refrigeration control settings remotely; no indicators have been published yet. [2]

What to do

  1. Confirm which refrigeration controls are connected to remote management and review who can reach them. [2]
  2. Review recent setting-change logs and watch the control vendor's advisories. [2][1]

Large enterprise

A security operations team

What to know

This is the second such incident in recent weeks, and no fix or indicators have been published in the coverage reviewed. [1][3]

What to do

  1. Inventory refrigeration and building controls across stores, including third-party managed systems, and review their remote access. [2]
  2. Set up alerting on temperature setpoint changes and follow vendor advisories. [2][1]

Sources

  1. [1]The Record · Nov 2, 13:00 UTC
    Second wave of suspected cyberattacks hits supermarket freezers across Europecontext
  2. [2]The Hacker News · Nov 3, 07:27 UTC
    New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Foodcontext
  3. [3]Infosecurity Magazine · Nov 3, 13:45 UTC
    Cyber-Attack on Refrigeration Systems Hits Supermarkets Across Europecontext