¿Qué sabemos de los ataques a los sistemas de refrigeración de Europa?

In recent weeks, cybercriminals have remotely raised temperatures to 55°C, causing food to spoil in approximately 100 supermarkets across Europe, resulting in losses of millions of euros. This marks the second time this year that supermarket refrigeration systems in Europe have been targeted, raising questions about the identity of the attackers behind these mysterious cyberattacks.

Over the course of the week, incidents were reported in nearly 100 stores belonging to various retail chains in Sweden, Finland, Ireland, Belgium, Luxembourg, and Estonia. These attacks, which remotely raise refrigeration unit temperatures to 55°C, follow a series of similar cybercrimes against 700 supermarkets in France during a single night in October.

The EU officials have described these incidents as a deliberate attack on the continent's food safety. No group has claimed responsibility. Attacks on industrial equipment, known in cybersecurity as operational technology (OT), have been documented since the early 2000s. However, such actions usually required specialized knowledge and targeted specific infrastructures in specific countries.

Perhaps the most well-known attack on OT systems was carried out by the United States and Israel in 2009 against Iran's nuclear program using malicious software called Stuxnet. Refrigeration units have been targeted before. Last year, the US Department of Justice accused a group of pro-Russian hackers of disabling refrigeration systems at a meat processing plant in California in 2024.

However, cybersecurity experts on OT systems point out that never before has a simultaneous attack on hundreds of similar targets been seen. Robert Lee, CEO of cybersecurity firm Dragos, explains that large language models have made it easier for attackers to gain the technical knowledge needed to target specific industrial equipment.

He adds that attackers have been helped by the fact that more equipment is now connected to the internet for remote management. "Adversaries have always wanted to attack OT systems," he says. "The changes we have introduced into our sector, such as connectivity and the transition towards a homogeneous infrastructure, combined with adversaries' growing knowledge and capabilities, have expanded the attack surface and made all this possible."

The attack was not technically complex. Hackers exploited known vulnerabilities to penetrate systems that remotely control the temperature of each unit. Among the affected suppliers during the attacks in France were Danfoss, a Danish company that urged its clients to update both hardware and software to fix a security gap in its control systems.

Meanwhile, supermarkets were advised to update their internet security configurations. "Having knowledge of this vulnerability, supermarkets and refrigeration companies began taking corrective measures, but not all establishments have completed steps to ensure secure internet connectivity," explains Stephan Moelans, CEO of Belgian refrigeration company Sabcobel.

This allowed attackers to use "a backdoor to access the controller and modify the refrigeration facility configuration" in those stores that lacked secure internet connectivity, Moelans notes. It is estimated that between 20 stores using their equipment were affected in the most recent attacks, including Carrefour, Spar, and Delhaize.

Those establishments that had implemented additional security measures, such as disconnecting from the public internet or using virtual private networks (VPNs) to protect the connection, remained unaffected despite the existence of this backdoor. Danfoss confirmed that its systems were compromised and reiterated that it had urged its clients to disconnect the equipment from public IP addresses, update firmware, and employ "appropriate network protection mechanisms."

Industrial company Copeland, backed by Blackstone and manufacturing the Dixell brand, confirmed on Tuesday that "certain" monitoring systems used to control refrigeration in supermarkets were "affected by the reported cybersecurity vulnerability" this week. Following the supermarket attacks in France in October, experts suggested that the perpetrators could be Western teenagers upset over something or an adversary backed by a state with a strategic objective.

While cyberattacks on computer systems typically leave some digital footprint, OT system attacks leave fewer traces, making it difficult to determine responsibility. Tom Hegel, a threat intelligence researcher at Sentinel, suspects that the attacks began in August, with a series of intrusions into the refrigeration systems of several US military bases.

Given the similarities, he considers it "very likely" that the episodes are related to the same group with ties to Russia. Russia's objective would be to cause economic and psychological damage in Europe, without being able to attribute responsibility directly to the country, Hegel explains. "It's a cheap attack to execute, but it generates a massive financial impact for Europe.