Supermarket freezers across Europe hit by second suspected cyber-attack
A wave of cyberattacks has remotely cranked supermarket freezers across Europe from deep-freeze to 50°C+, forcing retailers to dump food and exposing how many industrial refrigeration systems are directly reachable from the internet. Commenters trace the problem to insecure, often unpatched controllers (notably Danfoss units), default passwords, and cost-driven decisions to allow full remote control instead of read‑only monitoring for safety, compliance and energy management. The incident is framed as both preventable negligence and an early warning for much more critical networked infrastructure, with debate over whether this is state-backed hybrid warfare, bored hackers with Shodan, or simply the inevitable outcome of connecting “dumb” appliances to the public internet.
Scope, previous incidents, and impact
- Attackers remotely raised temperatures of thousands of supermarket freezers/fridges across multiple European countries, forcing food disposal.
- Commenters connect this to prior incidents: French supermarkets in October, US military commissaries earlier in the year, and now Sweden, Finland, Belgium, Netherlands, Estonia, Ireland.
- Some note patches and advisories were available months ago; many affected systems apparently remained unpatched and online.
Why are freezers online?
- Reasons cited:
- Regulatory “cold chain” logging and proof for inspectors/insurers.
- Remote alerting if temperatures drift, especially outside business hours.
- Centralized optimization for energy prices and load balancing with HVAC/power.
- Remote diagnostics, warranty conditions, and large-scale operational efficiency.
- Several argue these needs require monitoring but not remote control over temperature/defrost.
Security failures and blame
- Repeated themes: devices directly exposed to the public internet, default or predictable passwords (including “password of the day” based on the date), and poor segmentation (no VPN/VLAN/DMZ).
- Danish supplier Danfoss and related controller platforms are repeatedly mentioned; advisory links indicate known flaws and long‑recommended updates.
- Some see supermarkets and vendors as grossly negligent, especially after the French attack; others stress real‑world constraints: old hardware, tight margins, franchised stores, weak in‑house cyber expertise.
- Debate over fines and liability: are chains “victims” or co‑responsible for ignoring warnings?
Mitigations proposed
- Keep systems off the public internet; use LAN only, VPNs, strict firewalls, or air‑gapped local servers.
- Use unidirectional telemetry: read‑only monitoring, no remote write/control path.
- Stronger design: physical switches for defrost, limits that prevent unsafe temperatures, separate monitoring vs control hardware, alarms on alarm‑disablement.
- Short‑term incident response: disconnect vulnerable units, manual temperature checks/defrost cycles, later redesign.
Motives and broader implications
- Speculation ranges from nation‑state “hybrid warfare” (often Russia is mentioned) to bored kids, activists, or even “whitehat‑style” wake‑up calls; no consensus or evidence in the thread.
- Many see this as a textbook example of IoT/SCADA insecurity and a warning for more critical systems (hospitals, water, power, transport).
- Some foresee rising cybersecurity costs, insurance pressure, and possible regulation as necessary correctives.