By November 3, several retailers managed to restore some operations by severing internet connections to their refrigeration controllers. Meanwhile, others are scrutinizing equipment that operates outside their centralized networks, which are typically overseen by individual stores and contractors with remote access capabilities.
Reports indicate that employees at an ICA Kvantum store in Sjöbo, Sweden, discovered that refrigeration controls had been altered to maintain a high temperature of 50°C (122°F). A similar case was reported at an ICA store in Stockholm, where destroyed food was documented due to misconfigured settings. These incidents involved adjusted controls rather than verified temperature assessments of stored products.
A Belgian refrigeration firm, Sabcobel, reported that attackers shifted evaporators to a “defrost mode,” which resulted in the warming of the systems. Chief Executive Stephan Moelans disclosed that technicians worked overnight to disconnect affected systems from their networks, noting that restoring functionality sometimes required physical changes to ensure security rather than relying solely on software updates.
The disruption affected dozens of Delhaize stores in Belgium and Luxembourg, as well as multiple Carrefour locations. In Ireland, the Musgrave Group reported that refrigeration systems at 13 SuperValu stores were compromised, prompting precautionary removal of products until the threat was neutralized.
The attack was not restricted to supermarkets. The Association of Independent Meat Suppliers confirmed that three UK abattoirs were impacted, with the National Cyber Security Centre offering assistance to the organizations involved. In London, the wholesale provider Langridge Organic reported that attackers manipulated six of its ten cold-room controllers while disabling alarms designed to alert staff about temperature deviations.
The investigation into these incidents revealed that several retailers disconnected their affected equipment to mitigate further risks. Sweden’s ICA identified 23 impacted locations and indicated that their refrigeration systems fell outside centralized management. Other retailers, such as Coop, reported operational recovery in seven affected stores after isolating their cooling systems during a broader security evaluation.
Amid these occurrences, analysts have been drawing attention to the vulnerabilities inherent in refrigeration systems. A recent warning from France’s CERT-FR highlighted the risks of compromised Danfoss and Dixell controllers. Their advisory suggested eliminating public internet access to critical refrigeration controls, updating configurations, and implementing secure methods for remote maintenance, such as Virtual Private Networks (VPNs).
Experts emphasize that the underlying vulnerabilities existed before the attacks became public knowledge and continue to pose risks for food distribution infrastructure. With researchers identifying thousands of available refrigeration systems connected to the internet, they caution that this could enable adversaries to manipulate control settings, thereby jeopardizing food safety.
As these incidents unfold, business owners must reassess their cybersecurity posture. Preparing against possible future disruptions is imperative, especially as cyber adversaries increasingly target operational technology controls. The situation underscores the ongoing need for businesses to fortify their cybersecurity measures to prevent access points that could lead to significant operational impacts.
(Image by Pexels)