Refrigeration systems at supermarkets in nine European countries were reportedly disrupted on Monday, following an attack that affected about 700 of France's 10,000 supermarkets in October. France's national cybersecurity agency, CERT-FR, has linked the compromises to remote-control modules made by Danfoss and Copeland, two established suppliers of controls and components for commercial refrigeration. No group has claimed responsibility. The incidents underscore how supermarket refrigeration, much of it managed through internet-connected controls, can be disrupted remotely and at scale.

Stores in Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden reported problems. In Estonia, some refrigeration units were reportedly forced to reach 50°C (122°F). Italy's government was scheduled to hold a cybersecurity meeting on Tuesday, while CERT-FR warned that the campaigns were probably still ongoing.

The first reported wave occurred in France. Finance Minister Roland Lescure told Parliament on Oct. 13 that about 700 supermarkets had been affected. According to CERT-FR, hackers forced the systems into continuous defrost cycles, spoiling food and causing fires at some stores. The agency said it was aware of numerous compromises involving Danfoss and Copeland remote-control modules.

Groupement Mousquetaires, which owns the Intermarché and Netto chains, reported that 300 of its stores were affected. Cooperative U said 80 of its 2,000 shops had been hit. Lescure said food supplies were not at risk but acknowledged that the attack "touches the heart of our food security." Some Mousquetaires display cases remained out of service on Tuesday.

Monday's incidents affected several supermarket chains in Belgium. Carrefour reported disruptions at about 15 of its 700 stores. Belgian refrigeration contractor Sabcobel said evaporators had been switched into defrost mode — normally a periodic cycle for clearing ice buildup, but one that warms food compartments when forced to run continuously — and federal prosecutors opened an investigation. Four Delhaize outlets in Luxembourg also reported problems.

In Italy, Radenza Group, which operates Coop-branded stores in Sicily, said the attack began at 4 a.m. local time and targeted the remote-control system for frozen-food sections. Ireland's Musgrave reported that 13 SuperValu stores were affected, while Mosqueteiros confirmed incidents at seven Intermarché stores in Portugal.

At 50°C (122°F), a freezer is far beyond a safe operating temperature. Food left in those conditions for too long can spoil rapidly and allow bacteria to grow.

In Sweden, Coop said six of its roughly 800 stores were affected. The company said the stores used 4G connections, making them "more exposed." Ica said a limited number of its stores experienced problems and that the affected locations used an external Danfoss control system. Neither Swedish chain has confirmed that the incidents were caused by a cyberattack. Finnish retailer Kesko said network interference had not been ruled out.

EU Agriculture Commissioner Christophe Hansen described the incidents as a "deliberate attempt" to disrupt the food supply chain. Investigators have not established whether Monday's incidents are connected to the earlier attack in France.

Estonian refrigeration company Kitman Coldtech said the affected units were older Danfoss models similar to those attacked in France. CERT-FR warned that leaving an end-of-life device without security patches connected to the internet creates a very high risk of compromise.

Researchers at Claroty reported vulnerabilities in Danfoss AK-SM 800A controllers in August, including an authentication-bypass flaw. The AK-SM 800A line is used to monitor and manage refrigeration systems in supermarkets, and Claroty found 2,765 of those devices exposed online. Danfoss addressed the vulnerabilities in firmware R4.3.1, although it remains unclear which weaknesses the attackers exploited.

CERT-FR advises operators to remove the controllers from the public internet. Sabcobel's chief executive said many older units require physical modifications that involve investment. Until those changes are made, the oldest systems may have no practical technical fix. CERT-FR said the campaign was probably still active as Italy prepared for its cybersecurity meeting on Tuesday.

Source: Decrypt.