What is behind the Europe-wide cyberattacks on refrigeration systems

Maurice Forgeng, Epoch Times

In brief:

• On Monday, numerous supermarkets in several European countries became the target of a series of cyberattacks.
• In Bavaria, an EDEKA branch was allegedly affected as well.
• The targets are the freezers and refrigeration systems, after which the food usually has to be disposed of entirely.
• The attacks are made possible by IT security vulnerabilities.

Only on 12 October, hackers had knocked out the refrigeration systems in hundreds of supermarkets in France in a cyberattack. Now dozens of supermarkets in other European countries have been hit too.

Numerous countries affected

The new wave of digital attacks took place during the night to Monday, 2 November. According to “Euronews”, many supermarkets in Sweden, Finland, Belgium, the Netherlands, Ireland and Estonia were affected. In Luxembourg, a supermarket chain took protective measures as a precaution. An EDEKA branch in Reisbach is also said to have been affected.

The approach is mostly the same: the hackers gain access to the refrigeration systems’ software and switch them to defrost mode. As a result, the temperature in the freezers and refrigeration units rises to up to 50 degrees Celsius. Consequently, the affected branches can no longer sell the thawed food and have to throw it away.

Germany

In Reisbach in Lower Bavaria, an EDEKA store was allegedly hit on Monday. It wrote on Facebook:

“Last night, the refrigeration systems in our EDEKA store in Reisbach were heated up to 50 °C by a cyberattack! The sad result: huge quantities of food had to go in the bin.”

According to the EDEKA branch, the organisation foodsharing was able to collect everything “that could still somehow be saved” at short notice. However, the retailer had to dispose of most of the goods. “It simply makes us furious,” the branch wrote. It always works to avoid food waste. “And then people come up with the idea of deliberately destroying such quantities of food,” the branch said indignantly.

Shortly after the incident, the Lower Bavaria police headquarters launched an investigation. The authority is also already in contact with the responsible bodies in other affected countries. According to the police, however, there is as yet no technical evidence of a cyberattack.

Belgium

In Belgium, numerous freezers and refrigeration systems of the supermarket chains Delhaize, Carrefour and Spar were hit. According to Stephan Moelans, managing director of the refrigeration installer Sabcobel, the attack began as early as midnight.

Sabcobel says it knows of around 20 affected systems. According to its statements, the attackers switched the systems to defrost mode. A Carrefour spokesperson said that around 15 of the chain’s branches in Belgium had fallen victim to a cyberattack.

The butchers’ group De Laet en Van Haver also announced that there had been temperature rises in its refrigeration units.

Sweden

In Sweden, the supermarket chains ICA and Coop were victims of a cyberattack. ICA said that during the night the refrigeration and freezer systems in a “limited number of stores” had been impaired. “On ICA’s side, we are now supporting the stores in dealing with the incident,” wrote Gustaf Nilsson, press spokesperson at ICA, in a statement to “Aftonbladet”.

The Swedish company Coop said that seven Coop branches were affected by similar incidents. In total, Coop has around 800 locations in the Scandinavian country.

Coop had actually planned to update its system in several branches on Wednesday, 4 November – because of the incidents in France about three weeks ago. “One can hope that this will be speeded up somewhat and that it happens now rather than only on Wednesday,” said Coop press spokesperson Carlos Cancino.

Finland

According to Finnish media, several supermarkets of the K Group are also affected in Finland. The company is one of Finland’s largest retail chains. Some branches likewise reported temperature problems with their freezers. The cause is still being investigated.

Netherlands

In the Netherlands, at least 17 companies became the target of such cyberattacks on their refrigeration and freezer systems during the night to Monday. This was reported by a spokesperson for the manufacturer Danfoss. Danfoss did not say which companies exactly are affected.

Ireland

Reports of such an attack also come from Ireland. Here, 13 SuperValu branches experienced something similar, as the owner Musgrave told the “Irish Times”.

Estonia

According to media reports, there was another attack in Eastern European Estonia as well. Here, a branch of the supermarket chain Selver reported a similar incident.

Luxembourg

Lastly, the Belgian supermarket chain Delhaize suspended its ordering systems in Luxembourg. There was no attack here as in the countries mentioned above, but the company wanted to take precautions to prevent a similar incident.

Security vulnerabilities exploited

Danfoss, among others, explained how such extensive attacks could happen at all. The manufacturer said that customers without a software update were affected. According to this, the weak point lies primarily in outdated software. Danfoss has already advised its customers to urgently integrate the new software into their systems.

After the attacks in France, Vincent Strubel, head of the French cyber agency ANSSI, also spoke out. He said: “These were fundamental security failings, starting with the refrigeration systems being connected directly to the internet and managed without special security measures using weak passwords, through to similar problems.”

Likewise, in mid-October the Federal Office for Information Security (BSI) called on primarily “operators of small and very small industrial systems” to act. According to the BSI, “the most important and at the same time simplest protection […] is to disconnect the systems from the internet”. The authority named the use of VPN tunnels and multi-factor-protected access as further effective protection mechanisms. Whitelists for access authorisations and regular updates would also offer protection against attacks.

Perpetrators unknown

There are as yet no indications of who the attackers are. There has been neither a ransom demand nor demands of any other kind. The motive for these cyberattacks is therefore also unclear.

After the first wave of attacks in France, Gérôme Billois, partner at the cybersecurity and technology company Wavestone, analysed the attack. Billois said:

“The two most plausible scenarios are either that it was a group of teenagers or activists who wanted to blow up a few freezers to prove what they are capable of, or that it was a destabilising attack – what we call sabotage – carried out by internal or external state actors.”

However, there are so far no concrete indications of a state-sponsored attack from any particular country.

---

This article first appeared in German on Epoch Times – with kind permission of Maurice Forgeng.
Cover image: Akela999 / Pixabay