Danfoss Refrigeration Cyberattack: Europe Supermarkets Hit by Food Spoilage

• A recent cyberattack caused refrigeration failures in grocery stores across at least seven European countries, leading to widespread food spoilage.
• The incident mirrored an earlier attack on October 12 that affected hundreds of refrigeration systems in French retailers.
• Affected stores in Sweden used external refrigeration control systems from Danish manufacturer Danfoss, the same supplier targeted in the French attack.
• Some Belgian industrial refrigeration systems from Sabcobel remained vulnerable despite security efforts, contributing to the recent disruptions.
• The attacks highlight significant supply chain cybersecurity risks and the vulnerability of IoT devices in essential infrastructure.

These coordinated attacks underscore a critical supply chain cybersecurity risk, particularly concerning the increasing reliance on IoT devices within essential infrastructure like food retail.

Grocery stores across at least seven European nations recently experienced significant operational disruptions as their refrigerated units failed, leading to widespread food spoilage. Supermarkets in Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands, and Sweden were among those impacted, with temperatures inside cold cases soaring and necessitating the disposal of large quantities of perishable goods. This forced retailers to empty freezers and restock shelves with fresh items, incurring substantial losses and raising immediate concerns about food safety and availability.

The incident on Monday mirrored a similar cyberattack that occurred just three weeks prior, on October 12, when hundreds of refrigeration systems in French retailers were compromised. That earlier event also resulted in extensive food waste and prompted discussions about the resilience of the food supply chain. Specific retailers affected in the latest wave included Carrefour Belgium, which reported issues in approximately 15 of its 700 outlets, and an Ikea store in Mons, Belgium, where freezer temperatures abruptly rose. Other Belgian chains like Delhaize, Colruyt, and Intermarche also encountered technical problems with their refrigeration, with Delhaize additionally noting four affected stores in Luxembourg.

Investigations into the widespread refrigeration failures have pointed towards a common external factor: the Danish manufacturer Danfoss, which supplies the refrigeration control systems for many affected stores. Ica, a Swedish chain, confirmed that a limited number of its stores experiencing refrigeration issues were connected to a Danfoss system, the same supplier implicated in the October 12 cyberattack on French retailers. An Ica store in Sjobo, Sweden, explicitly stated via Facebook that its fridges and freezers had been "hacked" and their temperatures intentionally set to 50 degrees Celsius (122 Fahrenheit). Danfoss has not yet responded to inquiries regarding these incidents.

Further highlighting the interconnected vulnerabilities, the Belgian industrial refrigeration group Sabcobel had initiated efforts to secure its installations following the initial French attack. However, approximately 10% of their systems remained unpatched, and some of these were present in the shops affected on Monday. Sabcobel's chief executive, Stephan Moelans, indicated that the impact would have been far more severe had these proactive security measures not been undertaken. Meanwhile, Coop Sweden, which saw six of its roughly 800 stores affected, noted that the compromised units were linked to a 4G mobile network, rather than the more updated 5G system, suggesting a potential IoT device cyber vulnerability that made them "more exposed" to malicious actors.

These coordinated attacks underscore a critical supply chain cybersecurity risk, particularly concerning the increasing reliance on IoT devices within essential infrastructure like food retail. The incidents have not only caused immediate financial losses due to food spoilage but have also raised significant questions about broader food security. While no group has claimed responsibility for either the recent European grocery store hack or the earlier French incident, the pattern suggests a sophisticated and targeted effort to disrupt vital services.

The Finnish National Cyber Security Centre, through specialist Roni Kokkola, acknowledged the possibility of cyber interference in Finland, noting similar occurrences across Europe in recent months. Kesko group, a Finnish retailer, also detected irregular temperatures in some smaller grocery stores and is actively investigating the cause, not ruling out network interference. The repeated nature of these Danfoss refrigeration cyberattack Europe incidents highlights the urgent need for robust cybersecurity measures across the entire food supply chain, emphasizing the potential for operational and reputational damage from such sophisticated attacks.

This incident highlights critical supply chain cybersecurity vulnerabilities, particularly concerning IoT devices in essential infrastructure like food retail. Lawyers should advise clients on assessing their exposure to third-party vendor cyber risks, reviewing contractual obligations and indemnities with technology suppliers like Danfoss, and strengthening incident response plans to mitigate operational and reputational damage from similar attacks.

Source: Original reporting via AFP