Freezer Cyberattacks Spread to Germany, Romania and UK as Italy Holds Emergency Security Talks

Since hundreds of French supermarkets lost their refrigeration to hackers in October, a second wave hit overnight into Monday, Nov. 2. As of today, Nov. 3, the list of affected countries has grown beyond the nine first reported: Germany, Romania and the UK have now been added.

Supermarkets in Belgium, Estonia, Finland, Germany, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Romania and Sweden reported refrigeration problems. Britain, which is outside the EU, was also hit. Several retailers threw out food after temperatures climbed.

Italy convenes intelligence chiefs

Italy's government held emergency talks Tuesday with intelligence chiefs and the National Cyber Security Agency. The agency issued technical advice for retailers.

The government described the damage in Italy as "highly limited." "Only a small number of commercial units have been affected," its statement said. It blamed "outdated security systems, with interfaces exposed directly to the internet and weaknesses in authentication mechanisms."

About 20 outlets were reported hit nationwide. Giuseppe Spadaro, who runs the group managing Coop stores in Sicily, said four of its 300 stores were affected. The attack came at 4:00 a.m. and targeted "our remote-control system for frozen food sections," he said.

"We estimate the damage at several thousands of euros. We had to throw away everything. The shelves are empty," Spadaro told Corriere della Sera. He added that the company will invest more in security: "This shows that any connected device can become a target."

Who was hit and how

Belgium took some of the heaviest damage. Federal prosecutors opened an investigation. Carrefour Belgium spokesman Mich Vergauwen said about 15 of its 700 stores were disrupted. "It's a cyberattack, there is no other reason," he said. Delhaize, Colruyt and Intermarché also reported problems, as did four Delhaize stores in Luxembourg and an Ikea outlet in Mons.

Stephan Moelans, chief executive of the refrigeration contractor Sabcobel, said attackers switched cooling units into defrost mode. That mode is meant to clear ice. In these attacks it made units heat up instead. Sabcobel manages refrigeration for Delhaize. The company said it began securing installations after the French attack, but some systems had not yet been upgraded and were among those hit.

In Sweden, ICA said 23 of its stores were affected and eight had to dispose of refrigerated and frozen goods. An ICA spokesperson said all affected stores had equipment connected outside the company's centrally managed store network, and that central IT systems were untouched. At an ICA store in Sjöbo, fridges and freezers were set to 50°C.

In Ireland, Musgrave said 13 SuperValu stores were affected and pulled chilled and frozen products as a precaution. The company said the incident was resolved Monday afternoon and restocking began.

Germany reported four affected outlets and Romania six, according to officials and company representatives. In Estonia, a Selver freezer was set to 50°C but warmed only about 2-3°C before the problem was fixed in roughly 10 minutes, said Jann Mutso, chief executive of the supplier Kitman Coldtech. No products were damaged.

The equipment in the crosshairs

Danfoss, the Danish maker of refrigeration controls, said its products were involved, as they were in the French attack three weeks ago, according to The Hacker News. ICA's spokesperson said its affected stores ran on an outside control system supplied by Danfoss. Mutso said attackers reached the control computer of an older Danfoss system in Estonia.

The Hacker News also reported that Danfoss's security advisories page listed nothing about the attacks when checked Tuesday. The most detailed operator guidance remains an October alert from CERT-FR, part of France's national cybersecurity agency.

Danfoss is not named in every case. Musgrave did not identify the maker of its affected model. A Belgian butcher told Dutch broadcaster NOS that Copeland equipment was also hit. Copeland gave NOS no clear answer.

These controllers are essentially small computers. Contractors connect them to the internet so they can monitor stores and fix faults remotely. That convenience is also the opening.

Deliberate attack or amateur work?

EU Agriculture Commissioner Christophe Hansen called the incidents "a deliberate attempt to disrupt our food supply chain and undermine consumers' confidence in it." EU spokesman Thomas Regnier said, "These are not isolated incidents," but declined to name any culprit. The Commission convened its interinstitutional task force Tuesday, with law enforcement and cybersecurity agencies at the table.

Romania's view is different in tone. Dan Cimpean, director of the National Cyber Security Directorate, said, "It seems semi-amateurish. We do not suspect, under any circumstances, that it is a state actor." He said no other infrastructure was compromised.

No one has claimed responsibility for either wave, and it is not established that the French and the November attacks are linked. Richard Horne, head of the UK's National Cyber Security Centre, told the BBC the issue touched "the whole food supply chain" and that there were "a couple of instances where 'vulnerable technology had been exploited.'" Two members of the British Association of Independent Meat Suppliers told the BBC their fridges began to defrost.

The U.S. angle

Army Criminal Investigation Division is working with the Defense Commissary Agency and the Defense Criminal Investigative Service on outages at U.S. military commissaries. At least a half-dozen refrigeration systems at U.S. military facilities failed in August. Military officials confirmed in October they were working with French law enforcement. No source has tied the commissary outages to the European attacks.

The Retail and Hospitality Information Sharing and Analysis Center has issued two advisories since October. Its operational technology working group is scheduled to meet Thursday, Nov. 5, with security experts from Google Cloud for a briefing on the attacks.

The open questions are who is behind this and whether the October and November waves share an author. The task force meeting in Brussels, Belgium's federal investigation and the Italian talks are the first places any answer would surface.