Epidemic of Hacked Freezers Spreads Across Europe

Europe's freezers have gone rogue, with supermarkets in nine more countries reporting refrigeration systems that heated up overnight on Monday.

Stores in Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden reported problems, and Estonian units were pushed to 50°C (122 °F).

No group has claimed responsibility, so the only ones taking the heat are the freezers.

The outbreak has a patient zero in France, where Finance Minister Roland Lescure told Parliament on Oct. 13 that about 700 of the country's 10,000 supermarkets were affected.

According to France's CERT-FR, hackers forced a continuous defrost cycle, which spoiled food and sparked fires at some stores. CERT-FR said it was aware of numerous compromises of remote control modules made by Danfoss and Copeland.

Groupement Mousquetaires, which owns Intermarché and Netto, counted 300 stores affected, while Cooperative U said 80 of its 2,000 shops were hit. Lescure said food supplies were not at risk but acknowledged the attack "touches the heart of our food security." Some Mousquetaires display cases were still out of service that Tuesday.

Monday's wave hit several chains in Belgium, where Carrefour reported disruption at about 15 of its 700 stores. Sabcobel, a Belgian refrigeration contractor, said evaporators had been switched into defrost mode, and federal prosecutors opened an investigation. Four Delhaize outlets in Luxembourg also reported problems.

Italy's Radenza Group, which runs Coop-branded stores in Sicily, said the attack began at 4 a.m local time. and targeted the remote-control system for frozen food sections. Ireland's Musgrave counted 13 SuperValu stores affected, and Mosqueteiros confirmed incidents at seven Intermarché stores in Portugal.

At 50°C (122 °F), a freezer is well past hot-tub territory and turns basically into a low-powered steam oven or, worse, a bacteria incubator where germs grow quickly if food is left there too long.

In Sweden, Coop said six of its roughly 800 stores were hit and that they ran on 4G connections, making them "more exposed." Ica said a limited number of stores had problems and that the affected shops used an external Danfoss control system. Neither chain has confirmed a cyberattack, and Finland's Kesko says network interference has not been ruled out.

EU Agriculture Commissioner Christophe Hansen called the incidents a "deliberate attempt" to disrupt the food supply chain. Investigators have not said whether Monday's wave is linked to the French attack.

Estonian refrigeration firm Kitman Coldtech said the affected units were older Danfoss models similar to those attacked in France. CERT-FR warns that leaving an end-of-life device without security patches exposed to the internet carries a very high risk of compromise. Researchers at Claroty published flaws in Danfoss AK-SM 800A controllers in August, including an authentication bypass.

Claroty found 2,765 of those devices exposed online, and Danfoss fixed the flaws in firmware R4.3.1. It remains unclear which weaknesses the attackers used, and CERT-FR says the campaigns are probably still ongoing, while Italy's government was set to hold a cybersecurity meeting on Tuesday.