Germany, Romania and the United Kingdom on Tuesday joined the list of European countries affected by a suspected cyberattack targeting supermarket refrigerators and freezers, illustrating three weeks after a similar attack in France the vulnerability of the food supply chain in Europe.
“These incidents show, once again, how cyberattacks can disrupt essential services and affect the daily lives of citizens,” Thomas Regnier, spokesperson for the European Commission, said on Tuesday. However, he refused to point to any responsibility, referring to the investigations carried out by the various European national authorities.
The United Kingdom has been added to a list of countries affected since Monday, already including Germany, Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Romania and Sweden. The British National Cyber Security Center, the NCSC, thus mentioned “two or three examples where vulnerable technology had been exploited in the United Kingdom”, without further details.
The British Association of Independent Meat Suppliers also said some of its members had been affected, without losing any goods because the devices were empty. The incident should “serve as a reminder to all those involved in the food industry”, according to its spokesperson Tony Goodger.
On October 12, another suspected hacker attack targeted supermarket refrigerators and freezers, forcing them to throw away large quantities of food. No one has yet claimed responsibility for any of these waves of computer attacks. “These are not isolated incidents and, of course, we must collectively be resilient and prepared for these types of cyber incidents,” said the EU spokesperson.
“Throw it all away”
In Italy, where around twenty supermarkets were hit in Sicily (south), as well as a collective catering company in Tuscany (center) and a frozen food company in Emilia-Romagna (north), “the impact of these attacks is for the moment very limited,” declared the government after an emergency meeting Tuesday morning. “Only a few commercial establishments were affected”, and “no case of risk to the health of citizens attributable to thawing phenomena has been noted”, added the Italian executive.
According to the latter, most of the affected supermarkets were “equipped with obsolete security systems” but “the majority of the distribution chain is (...) equipped with up-to-date protection systems, capable of repelling malicious intrusions”. “Many groups have not been hacked because they have advanced and up-to-date security systems,” added Giovanni Arena, delegate for Sicily of the professional federation of distribution companies.
“By going through the call centers, which take care of the remote management and monitoring system of the refrigeration installations, (the hackers) managed to access the control parameters, by modifying the storage temperatures of the food,” he added, quoted by the Ansa press agency. Four of the 300 supermarkets of the Radenza group, which manages Coop brand stores in Sicily, were notably targeted.
“Semi-amateur”
“The defrosting of the frozen sections was triggered, which raised the temperature, programmed at -20°C,” explained Giuseppe Spadaro, the group's general director, to Corriere della Sera. “This represents several dozen kilos of products and we estimate the damage at several thousand euros. We had to throw everything away, the shelves are empty,” he added, saying he never thought a supermarket could “be the target of a computer attack.”
