U.K. officials cite weak and default passwords in the earlier French attack
France’s national cybersecurity agency, ANSSI, said it had identified compromised remote refrigeration controllers in Danfoss’s AK-SM and AK-SC ranges, Copeland systems and Dixell xweb systems as it mobilized to assist potential victims in France. The agency said it had been investigating refrigeration-system breaches since mid-October and was coordinating protective measures with “all sectors that could be affected.” ANSSI pointed to a security alert first published Oct. 12 that continued to receive regular updates.
British cybersecurity officials shed little light on the latest attack on Tuesday, instead pointing to what they called “legacy technology” and findings from the earlier French attack. U.K. cyber minister Liz Lloyd said: “The cyberattack on French supermarkets was a result of exploitation of known vulnerabilities. It’s a clear demonstration that poor cyber hygiene, like weak passwords, continues to put organizations at risk.” Richard Horne, head of the U.K. National Cyber Security Center, told reporters the French fridges had been “connected directly to the internet with default passwords.” A team from the center issued warnings and worked through Monday night contacting organizations that had “vulnerable technology exposed.”
Supermarkets in at least half a dozen European countries, including Sweden, Belgium, Luxembourg, Ireland, Italy and Estonia, reported problems on Monday after their fridges and freezers had been remotely taken over and warmed. The intrusions spoiled tons of food at a total cost of millions of dollars (euros). One Swedish supermarket said its fridges and freezers had been hacked and set to 50 degrees Celsius (122 degrees Fahrenheit).
The Athens case showed that the incidents were not limited to large supermarket chains. George Boubas, owner of a butcher shop in the Kifisia suburb, told private Greek Skai TV on Tuesday that someone had hacked the temperature control of a refrigeration unit, raising the temperature to 150 degrees Celsius (302 degrees Fahrenheit). Employees starting their shift at 4 a.m. first noticed the problem. It took a technician two hours to wrest back control of the unit’s temperature settings, although Boubas said the meat products were not affected. Boubas said the technician told him an area supermarket and a fast-food restaurant had experienced the same issue; those businesses switched off the Wi-Fi connection to their refrigeration units to restrict outside access.
Experts said the cyberattacks were a reminder of the risks that come as more things get connected to the internet. Katerina Mitrokotsa, a cybersecurity professor at the University of St. Gallen in Switzerland, said: “This attack is a wake-up call. We have filled our homes and shops with devices that are really small computers, yet we still treat them like ordinary appliances.” She added: “A fridge doesn’t look like a security risk, and that’s exactly why attackers like it.”
Mitrokotsa said: “Supermarkets connect their fridges so they can monitor temperatures around the clock across hundreds of stores, get alerts before food spoils, cut energy costs and let technicians fix faults remotely.” She added: “This saves money and reduces food waste, but every connected fridge is also an entry point that needs to be secured like any other IT system.”
The latest cases mirrored an attack that happened weeks earlier and affected mainly French and Dutch retailers. That earlier incident struck refrigeration systems in hundreds of supermarkets and independent stores across France, Belgium and the Netherlands. French cybersecurity investigators blamed problems with outdated remote-control modules made by Danish company Danfoss and U.S.-based Copeland. Danfoss said most affected systems were older products that no longer received software or security updates, while Copeland identified a vulnerability in discontinued controllers.
Experts said many businesses were rushing to embrace new technology while neglecting the vast network of connections they relied on for daily operations, including payment and ordering systems, warehouses, refrigeration and other building controls. Nicole Carignan, senior vice president of security and AI strategy at cybersecurity company Darktrace, said: “Organizations are pouring budget into AI and digital transformation while the systems that keep food cold, water clean, and lights on often run on hardware that has not been funded since installation.” She also said: “Nobody broke into these refrigeration systems with a zero-day,” using the term for a flaw that had gone undetected by the system’s creators and security reviews. “They got in through internet-facing controllers, end-of-life firmware, and default passwords. That is technical debt coming due.”
Advanced artificial intelligence systems from companies including Anthropic and OpenAI had recently drawn scrutiny after revelations that they had hacked organizations while evading human control. Experts said on Tuesday that they did not think the attacks were powered by AI. Carignan said: “There is no evidence AI was used, and the techniques did not require it.” Paul Chichester, the U.K. cyber center’s director of operations, said: “I think the key element of that is that this wasn’t an AI attack. This is using vulnerabilities that absolutely have been out there for a long period of time. And that’s where we really need to sort of focus on.”
Italian cybersecurity and intelligence officials were scheduled to meet Tuesday morning to discuss the incident, according to Italian news agency ANSA. Officials at the European Union’s executive Commission were also holding similar meetings. European Commission spokesperson Thomas Regnier declined on Tuesday to comment on who might have carried out the hacks, saying that was up to the bloc’s 27 national authorities to figure out. Regnier told reporters the incidents “are not isolated” and that Europeans “have to be collectively resilient and prepared for such cyber incidents.”
Investigators had not identified who was behind the attacks or why. The response reported so far focused on addressing known weaknesses and limiting exposure: the U.K. National Cyber Security Center contacted organizations with vulnerable technology, ANSSI issued and regularly updated its security alert, and the area supermarket and fast-food restaurant mentioned by Boubas disabled Wi-Fi access to their refrigeration units. The attacks remained under investigation Tuesday.