Cyberattacks on supermarket cold chains in Europe expose vulnerabilities

Cyberattacks on European supermarket fridges and freezers have exposed a vulnerability in the modern food retail supply chain that retailers may have underestimated. 

In a wave of attacks that begun in France in mid-October and spread to countries such as Belgium, Sweden, Ireland, Luxembourg, Finland, Estonia and the Netherlands at the beginning of November, hackers were able to remotely manipulate refrigeration systems, causing temperatures to rise dramatically and food to spoil and become inedible. According to Belgian media reports, some fridge temperatures rose as high as 70°C. 

A report published on Monday, 2 November by Euronews, a pan-European television and digital news network, explains that large supermarket refrigeration systems are run remotely by central management units that control temperatures, defrost cycles and alarms for every chiller and freezer in the store. 

Connecting refrigeration controls to the internet typically cuts unnecessary maintenance callouts because faults can be fixed remotely. Remote monitoring also enables supermarkets to keep the temperature records required under food safety rules automatically, rather than having staff check each unit multiple times a day. 

Euronews also quotes research published in October by the cybersecurity firm Forescout, which found 12,976 exposed refrigeration management services on 6,017 internet addresses in 99 countries and territories. 

In many instances, these were running on old technology and not protected against newer cybersecurity threats.  

Food processing, wineries, farms and others also under threat 

“The risk goes beyond supermarkets. The same systems are used in food processing, wineries, fruit stores, farms and hospital cooling equipment,” notes Euronews. 

“Attackers do not need sophisticated malware. Once inside, they can use the system’s normal functions to change temperatures, trigger defrost cycles or switch off alarms. Forescout notes that such changes can look like routine activity.” 

Forescout’s main recommendation is to take refrigeration management systems off the open internet and give contractors access only through secure remote access tools. 

It also urges operators to replace equipment that no longer receives security updates, scrap shared contractor passwords in favour of individual logins with multi-factor authentication and keep records of who changes secure information. 

According to the BBC, it is unclear who is behind the attacks. Meanwhile, the European Union (EU) has condemned what it said was “a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it”. 

The lesson here may be that cybersecurity is not simply an IT issue. It is also a food safety, operational resilience, supply chain and brand-protection issue.