Several hundred supermarkets across Europe reported failures of their refrigeration systems overnight into Monday. In some cases, refrigerated display units in the stores reportedly even started actively heating up. The result is property damage of an as yet undisclosed amount. Here are the key facts at a glance.
What happened?
Unknown actors managed to manipulate the digital control systems of refrigeration equipment in numerous supermarkets across several countries. The manipulation caused the refrigeration systems to fail. The first incidents occurred in France in mid-October. Last Monday, reports of similar incidents began emerging from other countries as well. German grocery retailers now also appear to be affected.
How exactly were the refrigeration systems attacked?
So far, the only confirmed fact is that the attackers gained access to control systems that are accessible via the Internet. There are several possible explanations for how this happened. One theory is that a service provider was compromised, while another suggests that vulnerabilities in the control software were exploited. Despite these theories, exactly what happened remains unclear as of the publication of this article. One detail shared by many of the incidents is the manufacturer of the refrigeration equipment involved.
What are the consequences?
Because the cold chain was interrupted, the food stored in the manipulated refrigeration systems had to be destroyed. This resulted in considerable financial losses. In some cases, there were reports of fires in the refrigeration units of individual stores.
Who is affected?
According to current information, supermarkets in France, Sweden, Belgium, Luxembourg, and Italy have been affected. Initial reports have also emerged from Germany. So far, outages at an Edeka supermarket in Bavaria have been confirmed. According to reports, a grocery retailer in Wetter, North Rhine-Westphalia, has also been affected. There have been further reports, but these have yet to be confirmed as of this article.
Who is behind the outages?
It is not yet clear who is responsible for the manipulation or what their motivation might be. Although the timing suggests a possible connection to the initial incidents in France, police and law enforcement authorities are not yet in a position to provide any confirmed information.
How can a refrigeration system be manipulated in the first place?
In most cases, refrigeration systems can be controlled and maintained remotely. To enable this, part of the control system is accessible via the Internet and is used by service providers for maintenance and monitoring purposes. If someone manages to gain access to these control systems, they can change temperature settings and limits at will. This can be achieved, for example, by stealing the relevant access credentials from a service provider or by exploiting a security vulnerability.
There have been numerous reports of the target temperature being set to 50 degrees Celsius or similar values. However, this does not necessarily mean that the refrigeration unit turns into a heater. Usually, the unit simply stops cooling and no longer switches on the compressor. As a result, the temperature gradually rises until it reaches ambient temperature.
In other cases, the system's defrost function was apparently activated as well. This switches on a heating element inside the unit, which is designed to melt ice buildup. The function uses the same technology found in domestic refrigerators and freezers – just on a larger scale.
What can affected supermarkets do now?
Germany's Federal Office for Information Security (BSI) recommends disconnecting refrigeration control systems from the Internet and installing all available security updates for the control software wherever possible. Older systems that no longer receive updates from their manufacturers will eventually need to be replaced.
In addition, refrigeration systems must be separated from the rest of a supermarket's network and placed in their own network segment. A hypothetical attacker must not be able to access the refrigeration control system from an office PC.
It is also advisable to carefully review and, if necessary, change the passwords used by external service providers for maintenance access.
Because the manipulation took place during the night, it was only discovered in the morning, when the damage had already been done. It is therefore advisable to implement temperature monitoring that operates independently of the refrigeration control system, using separate, dedicated temperature sensors. This would allow an alarm to be triggered if the temperature exceeds a certain threshold. Appropriate emergency response plans and notification procedures are also recommended.
Is there any danger to consumers?
No. In accordance with legal requirements, the affected food products that were no longer adequately refrigerated have been withdrawn from sale and destroyed. Overall, the situation is still evolving and subject to constant change. There is no threat to the food supply.
