Supermarket Freezer Cyberattacks Spread to Germany, Romania and UK as EU Warns Hacks Are ‘Not Isolated’

Hackers have struck supermarket refrigeration systems in Germany, Romania and the United Kingdom, taking the number of European countries hit in the freezer cyberattacks to at least 11, as the European Union promised a collective response and warned the incidents were “not isolated”.

FAKTA

• What happened: Refrigeration systems at supermarkets in Germany, Romania and the United Kingdom were hit in the latest wave of freezer cyberattacks, officials said on Tuesday 10 November.
• Scale: At least 11 European countries have now been affected in the hacking spree. On Monday 9 November, problems were reported in at least nine EU countries: Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden.
• New countries: Four supermarkets in Germany and six in Romania were affected. In the UK, hackers tried to target small meat-processing firms, with minimal impact.
• EU response: The bloc’s agencies are working with national authorities on a joint response. EU spokesperson Thomas Regnier said: “These are not isolated incidents, and of course, we have to be collectively resilient and prepared for such cyber incidents.”
• Blood banks: Cold storage units in at least three blood banks in France were also hacked. No blood products were damaged and no patients were affected.
• Attribution: France blames Iran’s Revolutionary Guards for the October attack on about 700 French sites; Iran denies the accusation. The November wave has not been attributed to any actor.

Freezer Cyberattacks Reach Germany, Romania and Britain

The latest wave struck on Monday 9 November, when supermarket chains in at least nine EU countries reported that the temperatures of their refrigerators and freezers had soared overnight. On Tuesday, officials and company representatives said four supermarkets in Germany and six in Romania had been affected, and the United Kingdom, which is not in the EU, was also hit.

Belgium was among the hardest-hit countries on Monday, with dozens of stores across several grocery chains reporting refrigeration failures, and federal prosecutors there have opened an investigation. In Italy, about 20 supermarkets were affected. Giuseppe Spadaro, director of a group that runs Coop supermarkets in Sicily, said four of its 300 stores were hit, causing thousands of euros in damage. “We had to throw away everything. The shelves are empty,” he told Italy’s Corriere della Sera newspaper.

Italy’s government held talks with the heads of the intelligence services and the National Cybersecurity Agency on Tuesday after the attacks, and Prime Minister Giorgia Meloni’s office said the incident had a “limited” impact. “There is no cause for alarm, although all the relevant institutional bodies remain on high alert,” it said in a statement.

In the UK, hackers tried to target small meat-processing firms, but the impact was minimal, said Richard Horne, chief executive of the National Cyber Security Centre (NCSC). Horne told the BBC the issue affected “the whole food supply chain”, and that there had been a couple of instances where “vulnerable technology had been exploited”.

In Sweden, the supermarket chain Coop said refrigerators and freezers affected overnight at seven of its stores had been connected to “old 4G networks”, and that the stores had since resumed normal operations. The chain said it had accelerated an upgrade, begun after the October attacks, to move its connected refrigeration equipment onto 5G networks and modern modems.

Danfoss, a Danish maker of refrigeration controls whose systems were again among those targeted, said it had been in close contact with customers for the past three weeks and recommended that the systems not be directly accessible from the internet. Frank Groenewegen, a cybersecurity expert at Deloitte in The Hague, urged retailers to check whether their refrigeration controllers were connected to the internet and running the latest security updates. “And if they don’t even know, then remove them from the public internet immediately,” he told Reuters.

Blood Banks Targeted in France

In France, authorities reported on Wednesday that cold storage units in at least three blood banks had also been hacked. The French Blood Establishment (EFS) reported that fridges housing blood products awaiting delivery to healthcare facilities had been targeted and that “specifically, temperature and defrost thresholds were set to excessively high levels”.

“Monitoring and alarm systems enabled the rapid identification of these anomalies” and “the affected equipment was either brought under control,” the EFS said. It added that the blood products were moved to other facilities, and that none was damaged and no patients were adversely affected. Technical teams have stepped up monitoring of all equipment and are working with the French National Cybersecurity Agency (ANSSI) and the Ministry of Health.

France Blames Iran for October Attack, but November Wave Unattributed

France on Monday 9 November blamed Iran’s Islamic Revolutionary Guard Corps for the cyberattack that targeted about 700 refrigeration systems in France during the night of 11 to 12 October. It was the first time the French government had directly accused Tehran of a cyberattack, and it specifically named the cyber command of the Revolutionary Guards and the Shahid Kaveh unit, which it said carried out the attack.

French officials named three alleged associates — Hamid Reza Lashgarian, who heads the Guards’ cyber-electronic command, and Mahdi Lashgarian and Reza Salarvand — and the Paris prosecutor’s office has requested international arrest warrants. Foreign Minister Jean-Noël Barrot said France would seek European Union sanctions, and Iran’s ambassador was summoned to the foreign ministry on Tuesday 10 November. Iran has rejected the accusation, calling it baseless.

France’s attribution covers only the October attack. The November wave has not been attributed to any government, and no one has claimed responsibility for it. Romania’s top cybersecurity official, Dan Cimpean, played down the threat, telling AFP: “It seems semi-amateurish. We do not suspect, under any circumstances, that it is a state actor.” The motive for the cyberattacks is unknown.

How the Attacks Work

The attackers have seized control of refrigeration controllers over the internet and switched the units’ evaporators into defrost mode, pushing temperatures from as low as minus 27C to well over 50C. In the October attack on France, some refrigerators were heated so much they caught fire — at least 15 fires broke out — and food losses were estimated in the tens of millions of euros.

The same method was used a week ago, when dozens of supermarkets across seven European countries were hit overnight, with around 40 Delhaize supermarkets in Belgium and Luxembourg the worst affected. After that wave, the EU’s food and agriculture commissioner, Christophe Hansen, called the repeated cyberattacks “a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it”.

Read more: Supermarket freezer cyberattack hits shops in seven European countries