Cyberattacks Alter Refrigeration Controls Across European Supermarkets, Forcing Food Discards
On November 2, attackers remotely altered refrigeration settings at supermarkets and food suppliers across multiple European countries, forcing stores to discard chilled and frozen food. Affected retailers include ICA (Sweden), Coop (Sweden), Delhaize and Carrefour (Belgium/Luxembourg), Musgrave Group/SuperValu (Ireland), Edeka (Germany), and UK suppliers including Langridge Organic and three abattoirs monitored by the Association of Independent Meat Suppliers. The incidents follow an earlier wave in France on October 12 that caused food losses and reported fires at hundreds of stores, investigated by CERT-FR. Attackers appear to exploit internet-exposed refrigeration controllers, including Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB systems, switching evaporators into defrost mode and disabling temperature alert messages. No attacker attribution has been established, and the UK's National Cyber Security Centre (NCSC) is assisting affected organizations.
Detalhes técnicos
Belgian refrigeration company Sabcobel reported attackers switched evaporators into defrost mode, warming equipment; some fixes required physical intervention rather than software patches alone. In the UK, Langridge Organic had six of ten cold-room controllers altered, with automated temperature-alert messages disabled; staff caught the issue via manual checks. Copeland confirmed its Dixell XWEB controls were identified in UK incidents and is circulating patching guidance. A prior Forescout Vedere Labs scan (reported October 26) found 12,976 internet-exposed refrigeration services across 6,017 public IPs in 99 countries/territories, highlighting the attack surface of management interfaces controlling temperature, defrost schedules, and alarms.
Remediação
CERT-FR recommends removing public internet access to refrigeration controllers, reviewing configurations, updating firmware, changing default passwords, and routing remote maintenance through a secured VPN or protected network. It warns that resetting an unsupported controller without addressing underlying weaknesses leaves it exposed to repeat compromise. Danfoss has similarly advised customers against exposing refrigeration controls directly to the internet.
Linha do tempo
-
Cyberattacks Alter Refrigeration Controls Across European Supermarkets, Forcing Food Discards
ler a análise desta fonte ocultar
On November 2, attackers remotely altered refrigeration settings at supermarkets and food suppliers across multiple European countries, forcing stores to discard chilled and frozen food. Affected retailers include ICA (Sweden), Coop (Sweden), Delhaize and Carrefour (Belgium/Luxembourg), Musgrave Group/SuperValu (Ireland), Edeka (Germany), and UK suppliers including Langridge Organic and three abattoirs monitored by the Association of Independent Meat Suppliers. The incidents follow an earlier wave in France on October 12 that caused food losses and reported fires at hundreds of stores, investigated by CERT-FR. Attackers appear to exploit internet-exposed refrigeration controllers, including Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB systems, switching evaporators into defrost mode and disabling temperature alert messages. No attacker attribution has been established, and the UK's National Cyber Security Centre (NCSC) is assisting affected organizations.
Technical Details
Belgian refrigeration company Sabcobel reported attackers switched evaporators into defrost mode, warming equipment; some fixes required physical intervention rather than software patches alone. In the UK, Langridge Organic had six of ten cold-room controllers altered, with automated temperature-alert messages disabled; staff caught the issue via manual checks. Copeland confirmed its Dixell XWEB controls were identified in UK incidents and is circulating patching guidance. A prior Forescout Vedere Labs scan (reported October 26) found 12,976 internet-exposed refrigeration services across 6,017 public IPs in 99 countries/territories, highlighting the attack surface of management interfaces controlling temperature, defrost schedules, and alarms.
Remediation
CERT-FR recommends removing public internet access to refrigeration controllers, reviewing configurations, updating firmware, changing default passwords, and routing remote maintenance through a secured VPN or protected network. It warns that resetting an unsupported controller without addressing underlying weaknesses leaves it exposed to repeat compromise. Danfoss has similarly advised customers against exposing refrigeration controls directly to the internet.