Hackers alter settings to disrupt supermarket refrigeration

Hackers have accessed the digital controls of commercial refrigeration systems and changed settings to raise temperatures in supermarket display cases, DR reports. Freezers and refrigerated cases in several European countries have been affected.

No one has claimed responsibility. EU Commissioner for Agriculture and Food Christophe Hansen called the attacks “a deliberate attempt” to disrupt European food security, according to Reuters.

Cybersecurity adviser Jens Christian Høy Monrad, founder of Arx Insight, said the attackers gained access to the systems that control professional refrigeration equipment. The exact method used in the attacks is not yet known.

These systems often rely on a central control unit to monitor and regulate temperatures. It can also let technicians detect faults, receive alerts and change settings remotely. If a system is accessible from the internet and has a software flaw, weak access controls or an insecure remote connection, an unauthorised person may be able to get in, Monrad said.

Reports indicate that attackers manipulated the defrost function. Activating it incorrectly or leaving it on for too long can raise temperatures enough to make food unsafe to store at the required temperature. The refrigeration machine itself does not need to be damaged if its digital controls can be made to issue incorrect instructions, Monrad said.

A supermarket in Sweden reported water on the floor, and several stores have had to throw away large quantities of food, Swedish broadcaster SVT reported. Some attacks took place at night, which may delay their discovery, but Monrad said this was not a technical part of the hacking method.

Responsibility for security can involve several parties. Supermarkets usually have refrigeration equipment installed by a supplier, and a third party, such as a refrigeration company, may manage the systems’ IT and have remote access. The supermarket still bears the losses from an attack and should understand the main risks, Monrad said.

Systems may need software updates, although some older models cannot be updated and may have to be replaced. Removing the equipment’s internet connection can be quicker, and is what authorities are recommending, he said. The involvement of Danfoss products does not mean Danfoss’s own IT systems have been hacked.