Supermarket fridge cyberattacks: what we now know about the Danfoss and Copeland controllers

New details have emerged about the supermarket fridge attacks that hit Europe this week. Our first report covered the headline facts. Here is what investigators and security researchers now say about how the attacks worked and what shops should do.

How big was the second wave?

More than 100 stores, from major chains to small butcher shops, saw fridges and freezers heat up overnight from Sunday to Monday (November 1 to 2), according to SecurityWeek. Affected businesses are in Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden, and problems were also reported in Finland, Italy and Portugal. Some units were set to 50°C (122°F).

• Belgium: Delhaize reported dozens of stores affected, Carrefour 15 locations out of more than 700, and Colruyt five franchised Spar shops. An Ikea store in Mons was hit, and the federal prosecutor’s office opened an investigation.
• Ireland: SuperValu pulled chilled and frozen products from 13 stores that use one specific refrigeration model.
• Netherlands: Danfoss said at least 17 businesses were hit, mainly butchers and small grocers.
• Sweden, Luxembourg, Finland, Italy, Portugal: ICA and Coop in Sweden, four Delhaize outlets in Luxembourg, a few Kesko stores in Finland, Coop-branded supermarkets in Sicily, and seven Intermarché stores in Portugal reported problems.

The first wave struck France overnight on October 11 to 12, when around 700 supermarkets had their refrigeration forced into defrost mode, including Intermarché, Carrefour, Coopérative U and Monoprix stores. Food was spoiled and fires were reported.

Which equipment was targeted?

• France’s CERT-FR first linked the attacks to Danfoss AK-SM and AK-SC controllers, then widened its alert to Copeland and Dixell XWEB systems.
• Dutch broadcaster NOS reported that, as far as is known, the devices hit in this wave were made by Danfoss and Copeland. An Estonian supplier said the attacked units there were older Danfoss models.
• Danfoss has said most of the hacked units were legacy products that no longer get updates.

How did the attackers get in?

Officials have not explained it publicly, but several clues point to the same weakness: controllers exposed to the internet.

• Security researcher Kevin Beaumont says people he spoke with confirmed that every freezer hit on Monday had a management interface reachable from the internet, and that many of the devices are end-of-life with no patch available.
• Security firm Lupovis saw suspicious logins against its decoy Danfoss controllers between October 20 and 30, peaking on October 26. Most attempts used factory-default credentials that Danfoss documents publicly. All attempts were rejected by the decoys.
• Internet scanning firm Censys found just over 1,000 Danfoss StoreView interfaces reachable online worldwide. In France the number fell from 1,825 before the October attacks to 220 now, but it estimates 41% of the French ones still online run a patched version.
• Danfoss says it told customers on October 13 to cut internet connections and reconnect only through a secure network. “Most stores took action at that time, but a small number did not,” a spokesperson said.

Stephan Moelans, CEO of Belgian refrigeration firm Sabcobel, says a software update alone is not enough and that some equipment must be physically modified.

Who is behind it?

Nobody has taken responsibility, and investigators have not established whether the two waves are connected. EU agriculture commissioner Christophe Hansen called the attacks a deliberate attempt to disrupt the food supply chain and erode consumer trust, and said the bloc’s food security is not under threat for now.

What should shops and businesses do?

1. Take refrigeration controllers off the open internet. Use a VPN or a secure network for remote access.
2. Change default usernames and passwords on every controller.
3. Replace or isolate end-of-life devices that can’t be patched.
4. Install the latest vendor updates and follow the manufacturer’s guidance, which in some cases includes physical changes.
5. Set up temperature alarms that alert staff by phone overnight, independent of the controller.
6. Talk to your refrigeration contractor and ask which controller models you have.

What should shoppers do?

Authorities say there is no wider food safety risk, since affected stores threw out spoiled food. Still, check that frozen and chilled items feel properly cold before buying and tell staff if a unit feels warm. Our first report has a short checklist. For a broader look at poisoned tools and devices, see our report on the cPGuard supply chain attack.

Frequently asked questions

How many stores were hit in the second wave?

More than 100 stores across several European countries, according to SecurityWeek, with problems in at least nine countries.

Which fridge controllers were attacked?

Danfoss and Copeland controllers appear to have been targeted, and France’s CERT-FR also warned about Dixell XWEB systems.

How did hackers get in?

It has not been confirmed. Researchers say the hacked units had management interfaces reachable from the internet, many were old and unpatched, and attackers were seen trying factory-default passwords.

Is food in supermarkets safe?

Authorities say there is no wider risk to food security, and affected stores removed spoiled food.

Sources

• Over 100 European stores hit as supermarket fridge attacks return (SecurityWeek)
• European retailers hit by supermarket fridge hack (Reuters)
• Cyber attack sabotages refrigeration systems of supermarket chains (Belga News Agency)
• European refrigerator controller redux: a new wave of refrigeration attacks (Censys)
• Weer aanval op winkelkoelingen door heel Europa (NOS)