Supermarkets across Europe have experienced a wave of cyberattacks targeting refrigeration systems, resulting in significant food spoilage and financial losses. Reports this week indicate that fridges and freezers in stores across several countries, including Sweden, Belgium, Luxembourg, Ireland, Italy, and Estonia, were remotely compromised and had their temperatures raised to dangerous levels.
In one instance, a Swedish supermarket reported its refrigeration units were set to 50 degrees Celsius (122 degrees Fahrenheit). A butcher shop owner in Athens, Greece, told Skai TV that a refrigeration unit was hacked to reach 150 degrees Celsius (302 Fahrenheit). Employees noticed the issue early in the morning, and it took technicians two hours to regain control. The shop owner stated that a nearby supermarket and a fast-food restaurant experienced similar problems, leading them to disconnect the Wi-Fi from their refrigeration units to prevent further access.
These incidents mirror a similar event that occurred weeks prior, primarily affecting retailers in France and the Netherlands. French cybersecurity investigators identified issues with outdated remote control modules from manufacturers like Danfoss and Copeland. Danfoss noted that many affected systems were older products no longer receiving software or security updates, while Copeland pointed to a vulnerability in discontinued controllers.
Experts are highlighting these attacks as a stark reminder of the security risks associated with the increasing number of internet-connected devices. Katerina Mitrokotsa, a cybersecurity professor at the University of St. Gallen, warned that while these devices are convenient for monitoring temperatures, receiving alerts, cutting energy costs, and enabling remote repairs, each connected fridge also represents a potential entry point for attackers that needs robust security.
Nicole Carignan, senior vice president of security and AI strategy at cybersecurity company Darktrace, observed that many organizations are prioritizing investments in new technologies like AI and digital transformation while neglecting the security of essential operational systems, including refrigeration. She described the breaches as stemming from "technical debt," with attackers gaining access through internet-facing controllers, end-of-life firmware, and default passwords, rather than sophisticated zero-day exploits.
Authorities in the UK have indicated that the cyberattacks exploited known vulnerabilities and poor cyber hygiene, such as weak passwords. Richard Horne, head of the UK's National Cyber Security Centre, stated that some affected refrigeration systems were directly connected to the internet with default passwords. The center has been issuing warnings and working to contact organizations with vulnerable technology exposed.
While concerns have been raised about the potential involvement of advanced AI systems in such attacks, experts currently believe AI was not a factor in these specific incidents. They emphasize that the exploited vulnerabilities are long-standing and do not require AI capabilities to exploit.
Investigations into the perpetrators and motives behind the attacks are ongoing. France's national cybersecurity agency, ANSSI, has been investigating refrigeration system breaches since mid-October and is coordinating protective measures. The agency has identified compromised remote controllers from Danfoss, Copeland, and Dixell systems. Officials at the European Union's executive Commission are also holding meetings, with spokesperson Thomas Regnier stating that the incidents "are not isolated" and emphasizing the need for collective resilience against such cyber threats.