Who is hacking Europe’s supermarket fridges and freezers, and why?

The EU has condemned what it called a deliberate attempt to disrupt our food supply chain and undermine consumers' confidence in it. The attack affected fridges in Belgian branches of Carrefour, Intermarché and Ikea, Coop and ICA in Sweden, Delhaize in Luxembourg, Kesko in Finland, SupaValu in Ireland and shops in Estonia.

Previous Attacks

This appears to be a reprise of attacks three weeks ago when French retailers had to dispose of large amounts of food after their fridges overheated due to hackers seizing control of their appliance management software. Similar incidents may have occurred in the US in early August when mysterious fridge malfunctions affected commissaries at least six military bases, with the Pentagon investigating a suspected hack.

Possible Culprits

No politically motivated hacktivist group has claimed responsibility, nor has a ransomware gang exploited the vulnerability. Rafe Pilling, Sophos' senior director for threat intelligence, suggested the most plausible scenarios are either some kind of state-based signalling and demonstration of capability or some kind of lone-wolf hacker that is conducting these attacks for their own personal reasons.

How the Hack Works

The hack exploits internet-connected software that manages commercial fridges. Unlike desktop or mobile devices, these systems often go without updates for long periods. Nick Jackson of Bitdefender noted that patching can be time-consuming, requiring machinery to be offline, which is problematic for retailers. He also suggested some operators may not be aware of the vulnerability.

In Monday's incidents, Coop in Sweden said some fridges were linked to a 4G mobile network, making them more exposed. ICA's system was provided by Danish company Danfoss, which had previous problems in France.

Defense Measures

The primary defense is patching software systems. According to Belgian refrigerator group Sabcobel, the impact of Monday's hack could have been far worse had they not started patching fridges after the October 12 attack in France. In the UK, which hasn't been affected yet, retailers are working with the National Cyber Security Centre to secure their systems.

The UK may be less vulnerable as internet-exposed refrigeration systems are most popular in countries like France, Italy, Greece and Belgium. Daniel dos Santos of Forescout noted the UK isn't in the top 10 for exposed systems, though he cautioned the risk wasn't negligible. The NCSC is working with its international partners and industry to fully understand details of an incident.