Hackers hit European shop fridges again as UK suppliers report incidents

UK suppliers pulled into a European wave

Chichester spoke at the launch of the NCSC's annual review. He said the agency was working with affected organisations. "At the moment, the impact is minimal," he said, according to The Guardian.

Anyone who buys chilled or frozen food depends on controllers that are often online. One tampered setting can empty a shelf. Retailers now face bills to patch those systems.

The attacks affected some of the more than 300 members of the British Association of Independent Meat Suppliers as "collateral", the association said. No meat disappeared. The units involved stood empty at the time. The European Commission is in direct contact with national authorities. It convened the EU interinstitutional Task Force with ENISA and Europol on the morning of 3 November, a spokesperson told CNBC.

The pattern started overnight into Monday, 2 November. Attackers changed settings on refrigeration controls at supermarkets in Belgium, Sweden, Estonia and other countries, The Hacker News reported on 3 November.

What the attackers actually changed

In Belgium, attackers switched cooling units into defrost mode. Stephan Moelans is chief executive of the refrigeration contractor Sabcobel. He told Belgian media that defrost mode should clear ice but instead made the units heat up.

At least one store reported temperatures of up to 50C (122F), CNBC reported. An ICA store in Sjöbo, southern Sweden, said its fridges and freezers had been set to 50C. Staff were throwing out goods, The Hacker News reported.

Danfoss, the Danish maker of refrigeration controls, said the attacks involved its products. The attacks also involved its products three weeks earlier, when attackers hit hundreds of French supermarkets, The Hacker News reported.

The earlier French attack involved legacy technology with an internet connection. Those systems ran on default passwords, The Guardian reported.

Counting the stores is harder than it looks

Totals depend on who is counting. BleepingComputer put the figure at more than 115 stores across Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia.

Ahold Delhaize said the attacks affected dozens of Delhaize stores in Belgium and Luxembourg. Food went to waste. BleepingComputer reported around 40 locations. Carrefour said the attacks hit 15 of more than 700 Belgian stores. That is about 2% of its estate there, with no hypermarket affected.

Intermarché said the attacks impacted 15 of its 153 Belgian stores, while The Hacker News listed 10 to 15. Coop in Sweden gave 6 stores to TT and AFP but 7 to Reuters and Bloomberg, out of about 800, under 1% of the chain. Musgrave, which owns SuperValu, reported 13 of 223 stores in Ireland, roughly 6%. The counts do not match.

Why shop fridges are exposed in the first place

Refrigeration controls are computers that run a store's fridges and freezers. They are often online so contractors can monitor them and fix faults remotely, as The Hacker News noted. Guidance has lagged. Danfoss's security advisories page listed no advisory about the attacks when The Hacker News checked on 3 November. The most detailed operator guidance was still an October alert from CERT-FR, part of France's cybersecurity agency.

Richard Horne, the NCSC's chief executive, called the fridge attacks the "foothills" of a larger cyberthreat. He warned that many more were waiting. Chichester said the attacks were not AI-enabled and used vulnerabilities that had been "out there for a long period of time".

What is still open

No one had claimed the attacks by Monday night. The Hacker News reported that a link to the French incident remained unconfirmed.

Belga News Agency reported the Belgian attack began around midnight on Sunday. Sabcobel estimated the attacks hit at least twenty units across Belgium, according to Belga's report cited by Tom's Hardware.

Cybersecurity experts told The Guardian that attacks on "dummy" fridge controls that were online showed characteristics similar to operations with links to Russia. A London fruit and vegetable wholesaler escaped escalation. Its managing director, Alex Pearce, said staff pulled the internet connection to its cold storage units out at the wall, The Guardian reported.