By Fatma Younis
Supermarket fridges and freezers in seven European countries malfunctioned this week after suspected cyberattacks remotely raised thermostats to as high as 50°C (122°F), prompting the European Union to condemn what it called a deliberate attempt to disrupt the food supply chain and undermine consumer confidence.
Scope of the Attacks
The incidents affected Belgian branches of Carrefour, Intermarché and Ikea; Coop and ICA in Sweden; Delhaize in Luxembourg; Kesko in Finland; SuperValu in Ireland; and shops in Estonia. The wave follows a similar attack three weeks ago in France that forced retailers to discard large quantities of spoiled food. A separate series of mysterious fridge failures at U.S. military commissaries in early August is also under investigation by the Pentagon.
Possible Culprits
No hacktivist group or ransomware gang has claimed responsibility. Cybersecurity experts say the two most plausible scenarios are state-based signalling to demonstrate capability or a lone-wolf hacker acting for personal reasons. Analysts note that Russia, China and North Korea are among the state actors with potential motive, and Western intelligence agencies have warned of an intensifying Russian sabotage campaign in Europe.
Technical Vulnerabilities
The refrigeration management software is connected to the internet, leaving it exposed when updates are delayed. Unlike consumer devices, commercial fridge software can go long periods without patches. In Monday's incidents, Coop in Sweden said some units were linked to a 4G mobile network, increasing exposure, while ICA's system was provided by Danfoss, the Danish company involved in the earlier French attacks.
Defensive Measures
Patching software systems is the primary defence. The Belgian refrigerator group Sabcobel said the impact could have been far worse had they not begun patching after the October attack in France. In the United Kingdom, which has not yet been hit, retailers are working with the National Cyber Security Centre to secure their refrigeration systems.
UK Not Yet Affected
According to cybersecurity firm Forescout, internet-exposed refrigeration systems are most prevalent in France, Italy, Greece and Belgium; the UK does not rank in the top ten. While the risk is not negligible, researchers assess it as currently lower for British supermarkets.
