Cyberattack hits grocery freezers in seven European countries
Hackers may have once again caused supermarket retailers in Europe to lose hundreds of thousands of dollars by manipulating freezer temperatures.
According to the BBC, refrigerators, freezers and chilled cabinets at dozens of supermarkets across Belgium, Luxembourg, Sweden, Ireland, Finland and the Netherlands were remotely set into defrost mode during the overnight hours of Nov. 1-2, reportedly causing temperatures to rise as high as 122 degrees Fahrenheit.
Stores from chains including Ahold Delhaize, Spar, ICA, Coop, Intermarche, Coopérative U, Carrefour, Shop & Go, Leclerc and Monoprix were affected, with losses in damaged fresh, frozen and dairy products reportedly exceeding $145,000 at some individual stores. Ahold Delhaize was the most severely affected, with roughly 40 stores in Belgium and Luxembourg hit by the cyberattack. One Ikea furniture store in Belgium also reportedly had its refrigeration systems affected by the attack.
Some of the Internet-connected units were supplied by Belgian company Sacobel. The breach is similar to an October security incident that caused roughly 350 supermarkets in France to have their freezers and refrigerators to heat up, and in some cases, catch fire, leading to millions of dollars in losses due to defrosted and perished food.
[READ MORE: Cyberattack on French grocery freezers causes spoilage, fires]
So far, no group has publicly taken responsibility or asked for any type of ransom in connection to any of these attacks. The hackers who struck grocers in France in October reportedly mostly targeted Internet-connected cooling systems provided by Danish software firm Danfoss, as well as some from Copeland and Dixell.
The most recent cyberattack also reportedly targeted Danfoss cooling systems used by at least 17 butcher shops and local grocers in the Netherlands. In a statement quoted by NBC News following the Oct. 12 incident, Danfoss said many of the affected units were at the end of their life and/or running outdated firmware, and that affected grocers had been warned to migrate and update outdated systems. In addition, in August a security weakness in a Danfoss software platform had been identified and patched.
In commentary emailed to Chain Store Age, Yuval Wollman, president of CyberProof, a subsidiary of UST, said these attacks are an escalation of “gray-zone hybrid warfare targeted directly at Western societal resilience” and offered advice to retailers seeking to protect their connected infrastructure.
“From a technical cybersecurity standpoint, this campaign exposes a critical vulnerability in operational technology security, where legacy physical infrastructure meets the public Interne,” Wolmlan said in the statement. “Attackers bypassed corporate IT networks entirely by targeting exposed industrial control interfaces from third-party cooling vendors.
“To withstand these breaches, remediation must shift from standard IT hygiene to an engineered resilience model using out-of-band validation and immutable physical fail-safes,” said Wollman.. “Organizations must enforce zero-trust, micro-segmented architectures to isolate vulnerable building management systems from third-party vendor networks.”
Wollman also advised that retailers with refrigeration units deploy analog backup systems like hardwired thermal interlocks and air-gapped mechanical overrides.
The latest incidents are currently being investigated by European and U.S. authorities. The U.S. is also reportedly now investigating whether issues with refrigeration units at American miliary installations in August may be related to these incidents. So far no group has so far publicly claimed responsibility or asked for payment related to the freezer malfunctions.
Ahold Delhaize USA, the U.S. subsidiary of Ahold Delhaize, had the e-commerce sites and apps of its five grocery banners down for about a week following a recent cyberattack.
This is a developing story and Chain Store Age will continue providing updates.
