Second wave of suspected cyberattacks hits supermarket freezers across Europe

A recent cyberattack has hit refrigeration systems at dozens of Belgian supermarkets, forcing stores to discard around €100,000 worth of food. At least 40 Delhaize supermarkets, 15 Carrefour stores, five Spar shops, and the butchery group De Laet en Van Haver were affected. Belgian media reported fridge temperatures rising as high as 70°C. The attack follows a similar incident on October 12, when hundreds of French supermarkets had their refrigeration systems compromised.

Large supermarket refrigeration systems are managed by central units that control temperatures, defrost cycles, and alarms for each chiller and freezer. Connecting these units to the internet has been supported for some time, allowing contractors to diagnose faults and adjust settings remotely. This reduces the need for technicians to visit each store, saving time and money.

Remote monitoring also helps supermarkets keep food safety records automatically, eliminating the need for staff to check each cabinet multiple times a day.

However, the split responsibility among contractors, store owners, and IT departments may contribute to the increased risk. A single party might not have complete visibility over the exposed service. Moreover, some of the equipment is outdated, with one Danfoss controller having been out of support since May 2021. This means it can no longer receive security updates, leaving it vulnerable to external breaches.

According to Forescout, a cybersecurity firm, 12,976 exposed refrigeration management services were found on 6,017 internet addresses across 99 countries and territories. Most of these belong to two product families: Copeland and Dixell’s XWEB systems, and Danfoss’s StoreView. Of the Danfoss services, 80% are running older firmware that no longer provides security fixes. These figures include systems that are exposed but not necessarily hacked.

The risk extends beyond supermarkets to food processing, wineries, fruit stores, farms, and hospital cooling equipment. Cybercriminals do not need advanced malware to cause damage. Once inside the system, they can manipulate temperatures, trigger defrost cycles, or switch off alarms, all of which appear as normal system activities.

Forescout recommends taking refrigeration management systems offline and providing contractors access through secure remote access tools. They also advise replacing unsupported equipment, using individual logins with multi-factor authentication, and maintaining records of changes to secure information.