European supermarkets hit by remote freezer attacks

The attacks involved controllers that set fridge temperatures. In France, the national blood service said hackers had reached the cold storage of at least three blood banks. The blood was moved, and no patients were harmed.

The controllers required little skill to breach. In France, they had been left on the open internet without firewalls, with admin screens guarded only by weak passwords, according to ANSSI chief Vincent Strubel. A Danfoss spokesperson said the Dutch systems that were hit were not on a secure network and still had their factory passwords. Default passwords for one company’s systems were printed in its manuals, according to Paul Chichester of Britain’s National Cyber Security Centre.

US security company Claroty found at least 1,000 Danfoss store systems were exposed online worldwide on the day of the November attack. Sabcobel, Belgium's refrigeration industry group, said damage would have been much worse if members had not begun patching vulnerabilities after 12 October.

No group has claimed responsibility or demanded money. Romanian cyber security director Dan Cîmpean called the attacks "semi-amateurish". Tom Hegel of SentinelOne noted Russian-aligned groups as credible suspects but described that as "only context, not the missing evidentiary link".

Samuli Bergström, formerly of Finland’s national cyber emergency team and now at WithSecure, suspected the motive was “less about food than about opportunity”. Retailers’ defences are generally weaker than those of banks or energy companies, he said, and “if the security is poor, someone will find it”.

Claroty had published details of security holes in Danfoss and Copeland controllers in August. A day after the French attack, the company showed that an AI tool could build a working attack on those holes, on a test device, in about 28 minutes at a cost of US$6 (about $9). Belgian butcher Luc De Laet told Reuters he lost about €15,000 ($24,000) of meat in a single night.

No attacks have been reported in Australia. Woolworths is understood to have no store refrigeration controllers connected to outside networks, and Aldi is similarly understood not to manage its fridges via external networks. Coles did not respond to questions.

Two days after the French attack, the Australian Signals Directorate issued an alert to businesses running refrigeration and cooling systems. Australia’s critical infrastructure laws cover the supply networks of grocery giants Woolworths, Coles and Aldi but do not explicitly cover the freezer aisle. It is unclear whether hacking a single store’s freezers would materially affect those networks. Home Affairs would not say whether it had spoken to any supermarket.

Leah Pinto, a director in the intelligence team at Melbourne-based CyberCX, said attackers are getting better at hitting internet-connected gear that runs lifts, air-conditioners and fridges. She said they are also keener to try, particularly as criminals experiment with artificial intelligence.

"If a failure can harm the public within days, it belongs in that category," Bergström said of the threshold for classifying cooling systems as critical infrastructure.