Freezer Hack Reaches UK Meat Suppliers; Danfoss Says Some Hit Systems Used Default Passwords

Since Monday, Nov. 2, when supermarket refrigeration systems overheated in seven European countries, the fallout has crossed the Channel. Britain's National Cyber Security Centre (NCSC) said it is aware of "a couple of instances where vulnerable technology had been exploited in the UK." A day earlier, the agency had said no UK incidents had been reported.

NCSC chief executive Dr Richard Horne told BBC Radio 4's Today programme that his agency "worked through the night" to warn potentially affected organisations. He said it is still "too early to say" who is behind the attacks.

British meat suppliers caught in the blast

The British Association of Independent Meat Suppliers (AIMS), which has more than 300 members, said some of them became what it called "collateral." Two members saw their fridges begin to defrost. A third saw cold units rise to 100°C (212°F), AIMS said.

AIMS spokesman Tony Goodger said the affected units were empty, so no produce was lost. He urged food businesses at every point in the supply chain to stay alert because they "may be seen by some as targets."

The UK cases are small next to what happened on the Continent. Around 40 Delhaize stores in Belgium and Luxembourg were hit, along with 13 SuperValu shops in Ireland and several ICA and Coop stores in Sweden. Carrefour said 15 of its more than 700 Belgian stores were affected. A Delhaize store in Hoeilaart told Het Laatste Nieuws it lost €100,000 of produce.

The vendor and the password

The equipment question is getting sharper. A Danfoss spokesperson told Bloomberg that the November incidents involved its products, as the French attack in October did. Danfoss told NL Times that some systems targeted in the Netherlands, where at least 17 businesses were hit, were connected to unsecured networks and still used default passwords. Those sites included butcher shops, small neighborhood stores and a frozen-food storage facility.

Danfoss had said after the French attack that the hacked units were older machines it could no longer patch. Copeland equipment was also reported affected in Belgium.

Sabcobel, the Belgian company that makes some of the affected units and runs Delhaize's systems, tells a different story about the fix. CEO Stephan Moelans said the units need physical modifications, not just software updates. He said most customers moved to a secure internet connection after France, and that this remains the simplest interim step.

That leaves a dispute over where responsibility sits. Danfoss points to how customers configured their systems. Sabcobel points to hardware that cannot be fixed with a patch alone. Horne put the burden on owners: "It's your business. It's your charity. It's your life. You need to make the choice and choose wisely."

He said the technology base society relies on "has not been invested on to the extent it needs to be," with many firms running systems past end of life and not isolating them from the internet. Horne also said "AI in the hands of our adversaries" lets such weaknesses be found and exploited faster.

Still exposed

Researchers say the door has not been shut. Daniel dos Santos, vice-president of research at Forescout Technologies, told Bloomberg that nearly 5,000 Danfoss systems were still exposed online in the week before Nov. 2. Christiaan Beek, vice-president of intelligence at Rapid7, counted nearly 1,000 still online after the latest attacks became public.

Vincent Strubel, head of France's national cybersecurity agency, blamed the October attack on "basic security shortcomings," citing fridges left exposed to the internet "without any particular security and with weak passwords."

Sweden's national cybersecurity centre head, John Billow, told Reuters the country has "quite a lot of exposed operational technology devices" that need updating or patching. Finnish broadcaster Yle reported that retailer Kesko, which found temperature problems at several small K-food stores, had not ruled out network interference. According to Yle, the affected refrigeration equipment was not covered by Kesko's centralized security protections.

In Estonia, attackers accessed a computer controlling refrigeration equipment at a Selver supermarket and set it to 50°C, according to the Associated Press. The incident was caught and resolved within minutes.

Who is behind it

No one has been named. Authorities in several countries have voiced fear of state-sponsored hybrid attacks, according to the Guardian, but no government has attributed either wave to a state.

EU agriculture commissioner Christophe Hansen called the repeated attacks "a deliberate attempt to disrupt our food supply chain and undermine consumers' confidence in it."

French prosecutors are treating the October attack as a cybercrime case. U.S. authorities are investigating refrigeration failures at several American military bases in August and are working with French officials to see whether the incidents are linked.

The open question for retailers is timing. With roughly 1,000 Danfoss systems still reachable online, the attackers' method has not been closed off, and Sabcobel says some fixes require physical work on the units themselves.