European Supermarkets Face Another Wave of Refrigerator Cyberattacks

Supermarkets across Europe are facing another wave of cyberattacks, just weeks after a similar incident, bringing down their internet-enabled refrigerators and risking the safety of food.

The attacks affected refrigerators in Belgium belonging to Carrefour, Intermarché, and Ikea, as well as fridges in Sweden belonging to Coop and ICA, Luxembourg fridges belonging to Delhaize, Kesko in Finland, SuperValu in Ireland and various shops in Estonia, according to The Guardian.

The fridges all had controls that could be remotely accessed over the internet, which hackers used to turn the temperatures up to 50 C (122 F) in some cases.

EU Agriculture and Food Commissioner Christophe Hansen told POLITICO the attacks were "a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it."

No one knows who is responsible for the attacks or what their motives could be. No groups have come forward claiming responsibility and demanding payment.

The situation mirrors a series of attacks against supermarkets across France just weeks earlier, affecting around 700 retailers.

The incident was caused by the software of at least three vendors, Danfoss, Copeland, and Dixell, being exposed to the open internet, exposing them to hackers.

Many of the affected units were end of life and "no longer receive software or security updates," according to Danfoss. They urged owners of their fridges to "keep supported systems updated with the latest firmware."

Before the attack happened, more than "1,700 instances of the affected Danfoss sower were exposed to the internet." Vulnerabilities in the controllers that could allow attackers to control the temperature settings for fridges running the outdated software.

The attackers removed the normal limits for temperatures that the fridges could be set to and set them to 50 degrees celsius (122 degrees Fahrenheit), leaving the fridges to entirely thaw overnight and even catch fire in some cases.

Hackers attacking utilities aimed at contaminating the water supply have been documented in the past, and now it seems a new type of attack aimed at the food supply is on the table.

While connected refrigerators might be convenient, they require owners to set them up properly and keep up with security updates to keep them secure.

If store owners are unwilling or unable to keep up with security updates, it's questionable why internet-connected appliances are really necessary in the first place.