Second Wave of Cyberattacks Target Supermarket Refrigeration Systems Across Europe
In recent developments, a second wave of suspected cyberattacks aimed at supermarket refrigeration systems has emerged across Europe, amplifying concerns regarding the vulnerability of connected technology. These attacks bring to light the alarming ease with which cybercriminals can disrupt physical operations without needing advanced malware.
The incidents were reported on November 2 and impacted refrigeration units in seven European nations, including Belgium, Sweden, Luxembourg, Finland, and Ireland. Several prominent supermarket chains such as Carrefour, Intermarché, Coop, ICA, and Delhaize have been affected. Alarmingly, some refrigeration temperatures were manipulated, rising to heights of 50°C, posing significant risks to food safety.
These recent attacks follow a series of concerning incidents in France in October, where compromised refrigeration controls resulted in extensive food spoilage. While the identities and motivations of the attackers remain unknown, the incidents have starkly highlighted the susceptibility of internet-connected operational technology to disruptive actions.
The Scale of Vulnerability: A Global Concern
Research conducted by Forescout Research – Vedere Labs underscores the extensive potential vulnerabilities in refrigeration systems globally. The research identified nearly 13,000 internet-exposed refrigeration service observations across 99 countries, linked to approximately 6,017 distinct public IP addresses. Notably, many of these identified systems utilize outdated software, which increases the likelihood of cyber exploitation. Specifically, thousands of exposed services are associated with Copeland/Dixell XWEB and Danfoss StoreView refrigeration management systems.
These systems help operators remotely monitor and manage refrigeration equipment, essential for maintaining the quality of perishable goods across supermarkets and other temperature-sensitive environments. However, when management interfaces are publicly accessible, attackers can tamper with temperature settings or disable units, leading to adverse consequences beyond the supermarket sector. Industries reliant on dependable cold-chain infrastructure, such as food processing, logistics, and pharmaceuticals, also face considerable risks.
Experts Sound Alarm on Consequences
Dray Agha, a Senior Manager at Huntress, expressed concern regarding the vulnerabilities in connected retail infrastructure exposed by these incidents. He warned that attackers were exploiting unsecured remote access capabilities to compromise cooling units and wreak havoc on essential stock. Agha stressed the need for retailers to prioritize firmware updates and limit unnecessary internet connectivity to operational systems.
He stated that these destructive strikes would persist unless the sector begins to recognize its heating and cooling networks as critical security targets. Furthermore, the complexities of securing older Internet of Things (IoT) devices pose additional challenges, as many must remain operational amid rising security threats.
Nathan Davies-Webb, Principal Consultant at Acumen Cyber, shared insights on how emerging technologies like artificial intelligence could be aiding attackers in pinpointing weaknesses in connected devices. He noted that the maintenance demands of older systems often compromise security, as these technologies prioritize availability over stringent security measures. The financial justification for replacing aging devices becomes elusive, even when their continued operational function poses heightened risks.
The Broader Threat Landscape
Findlay Whitelaw, Field CISO at Exabeam, raised critical questions regarding the extent of other essential business services that rely on remote-accessible equipment with inadequate cybersecurity oversight. Drawing parallels between the recent attacks in France and the ongoing breaches across Europe, Whitelaw pointed out the evident consequences: spoiled food, financial loss, and operational disruption. He emphasized that systems such as heating and ventilation could exhibit similar vulnerabilities, necessitating a comprehensive understanding of access control and risk management strategies.
Iain Davidson, Head of Product Marketing at Wireless Logic, echoed the warning about the fallout of relying on outdated operational technology connected through various networks. He highlighted that compromised refrigeration equipment could reverberate throughout the supply chain, affecting food safety and product availability. Davidson advocated for network-level monitoring to detect unusual activities, especially as older equipment often resists simple upgrades.
Retailers Maintain Confidence Amid Cyber Risks
Despite the rising threat of cyberattacks targeting physical operations, a recent study from Beazley’s Risk & Resilience research revealed that many retailers remain confident in their ability to withstand such incidents. About 87% of retail businesses reported feeling well-prepared for cyber risks, and 82% expressed confidence in their ability to recover financially post-attack. Nonetheless, only 23% recognized technology disruption as a major risk factor, leading to skepticism about their preparedness.
The financial implications of cyber incidents extend far beyond the immediate costs of equipment repair or system restoration. Investors must consider the costs of spoiled inventory, interrupted transactions, and the additional labor required for compliance with food safety standards.
Urgent Call to Action for Organizations
As the second wave of cyberattacks intensifies, attention is being drawn to a category of connected technology that often receives less consideration than conventional IT security. Unlike traditional cyber threats such as data theft or ransomware, interference with refrigeration controls can lead to immediate, tangible consequences.
Security specialists are urging organizations to identify exposed systems, limit remote access, implement available firmware updates, and maintain vigilance in monitoring unusual activity. Furthermore, operational technology must become a crucial focus in incident response and business continuation strategies.
With the likelihood of further attacks looming, there is escalating pressure on retailers and businesses reliant on connected infrastructure to enhance their understanding of the cybersecurity landscape surrounding their operational technology. As cybercriminals continue to exploit vulnerabilities, the urgency of addressing these threats cannot be understated.