Euronews and the Guardian report that supermarket refrigeration controllers in nine countries were hit on 2–3 November after days of probing; a security firm points toward Russia, but nobody has claimed or confirmed responsibility.
Refrigeration systems in supermarkets across nine European countries, along with several blood banks in France, were attacked on 2 and 3 November, Euronews reports. Hackers exploited weak security and vulnerabilities in Danfoss's AK-SM refrigeration system manager to switch fridges and freezers into defrost mode, in some cases pushing temperatures as high as 50°C, and many grocers had to throw away spoiled produce. The Guardian describes a London fruit and vegetable wholesaler who noticed defrost lights glowing on his units and pulled the cable from the box linking them to the internet; retailers in Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden reported similar faults.
The question of who was responsible remains open. The security firm Lupovis says its honeypots, decoy systems that imitate real devices, recorded more than 276 attempts from 91 different actors matching Danfoss controller components between 20 and 30 October, peaking on 26 October, and traced some activity to so-called bulletproof hosting that Russian groups have used before. Its chief executive, Xavier Bellekens, says a state actor fits the pattern of a coordinated operation, but he stresses that the firm is not certain it was Russian. The Grocer's technology editor, George Nott, cautions that no ransom demand or claim of responsibility has appeared and that the culprit could be anyone from a state-backed group to amateurs, and national agencies are not even agreed on the label: Belgium, Luxembourg, Italy, Portugal and Estonia call it a cyberattack, Sweden and Ireland a cyber incident, and the EU cybersecurity agency ENISA has stopped short of calling it an attack.
What experts do agree on is how basic the weaknesses were. Attackers reportedly found log-in pages on the open internet and used already patched vulnerabilities and weak passwords, and the UK's National Cyber Security Centre says the hackers did not need AI because default passwords were published in manuals. Danfoss told the Guardian that most affected equipment was old and no longer received security updates, and Lupovis argues that placing such controllers behind a VPN rather than directly on the internet would have removed much of the risk. NCSC chief Richard Horne has warned that the world is in the foothills of a wave of incidents, while the agency's founding chief, Ciaran Martin, calls this a bad run but not unprecedented, comparing it to NotPetya and WannaCry in 2017.
