Cyber attacks on refrigeration systems have affected supermarkets in Belgium, Sweden, Luxembourg and Estonia, with temperatures in some cases set at 50°C and food having to be thrown away. After the case of France, here’s how hackers can act and how to protect plants in Italy too.
In the night between Sunday 1st and Monday 2nd Novemberthere were problems with refrigerators and freezers of different supermarkets located in Belgium, Sweden, Luxembourg and Estonia: the plants have registered abnormal increases in temperature (with reports up to 50 °C), putting food preservation at risk. In some stores it was necessary to throw away some of the products. Several incidents have been attributed to cyber attacks to the refrigeration systems, but it is not yet certain that they are all connected.
A similar case had already been found in October, when hackers hit the refrigerators of numerous French supermarkets. The risk also concerns theItalyso much so that theNational Cybersecurity Agency (ACN) has published an alert with the measures to be taken to protect the plants and prevent similar accidents.
What’s happening to European supermarkets
In Belgium, the chain Delhaize confirmed a computer incident to the refrigeration systems of approximately 40 points of salespecifying that it has adopted measures to keep them operational. The anomalies also concerned at least 15 Carrefour supermarketsone Intermarché fortnight And 5 Spar stores. Some supermarkets of the group were also involved in Luxembourg.
In EstoniaHowever, a cyber attack hit one of the chain’s supermarkets Selverwhere hackers managed to change the temperature settings of a freezer. According to the company, the rapid intervention of the technicians made it possible to avoid damage to the food.
Always in Belgiumthe temperatures of refrigerators and especially freezers have risen to around 15°C in various stores, compromising the conservation of food. The manager of a Delhaize supermarket said he found the systems in defrost mode during the night and was forced to throw away fresh and frozen products.
In Swedenthe chains ICA And Coop reported similar problems. An ICA outlet attributed the incident to a hacker attack, claiming that refrigerator and freezer settings had been derailed. 50°C. Sweden’s national cybersecurity center is investigating reports in the country.
How hackers can change the temperature of refrigerators
In supermarkets, refrigerated counters and cold rooms can be connected to electronic control units which manage the temperature, report any faults and allow maintenance workers to intervene even remotely. These systems fall within the scope ofOperational Technology (OT)that is, technologies used to control equipment and physical processes.
Remote access facilitates maintenancebut it can turn into a weak point if a control interface is exposed on the Internet without adequate protections. Anyone who manages to access the system without authorization can, depending on the available functions, modify the operating parameters, for example those of the automatic defrostthe procedure that eliminates accumulated ice in the system by temporarily stopping cooling and, in some models, using heat. If this cycle is prolonged unduly, the products risk deteriorating.
In the French case, the attackers had extended the defrost cycles from one hour to eight hoursdelaying the activation of alarms and, consequently, the intervention of staff. After those episodes, the CERT-FRthe French cyber incident response center, confirmed numerous controller compromises Danfoss and systems Copeland And Dixell. However, it is not yet established that the events of November 2nd exploited the same attack equipment or methods.
Can it happen in Italy too? How to protect supermarkets and the cold supply chain
Similar attacks are also possible in Italywhere large-scale retail trade uses refrigeration systems that can be monitored and managed remotely. This Not However, it means that every supermarket is vulnerable: the risk depends above all on how the devices are configured, who can access them and the presence of updates and security measures.
On 13 October, following the French events, theACN published a bulletin with urgent verification and mitigation measures aimed at large-scale organized distribution, food logistics, industrial refrigeration and companies that deal with maintenance. The alert did not concern an attack already confirmed in Italy, but the need to prevent similar incidents.
The first recommendation is check which control units and remote assistance services can be reached from the Internet and eliminate direct exposure of control interfaces. When technicians need to connect remotely, it is best to use secure networks or enterprise-grade VPNs, with limited access to necessary equipment and multi-factor authentication. Default or shared passwords should also be replaced, and unused accounts should be disabled.
Another measure consists of separate the network that manages the plants from the one used for normal IT activities in the supermarket. This way, a problem affecting computers or business services is less likely to spread to refrigeration equipment. It is also necessary check for available updates And plan to replace obsolete devices that no longer receive security fixes, without uncontrollably interrupting refrigeration.
Prevention, however, does not depend only on the individual point of sale. According to the ACN, IT managers, plant managers and maintenance workers they must coordinate checks and also check connections with external suppliers and platforms that manage multiple stores. If a single console allows you to change the settings of numerous supermarkets, a compromise could impact multiple locations. This is why it is important to limit access privileges, record interventions and prevent an account authorized for one store from reaching all the others indiscriminately.
In the end, It’s not enough to check that the refrigerator is turned on. Monitoring must concern actual temperatures, defrost cycles, alarm thresholds and notifications, possibly also using tools independent of the supervision system. If anomalies emerge, the staff must be able to promptly involve the technicians, secure the systems and evaluate the condition of the food. In cases of suspected compromise, the ACN also recommends: promptly report the accident to CSIRT Italythe national structure that deals with the response to cyber incidents, through institutional channels.
