LONDON (AP) — Mysterious cyberattacks on European supermarket fridges have sent officials around the continent scrambling to figure out the cold, hard facts.
Supermarkets in a number of European countries reported this week that their fridges and freezers warmed up after they were remotely taken over, resulting in tons of spoiled food at a total cost of millions of dollars (euros).
One Swedish supermarket said its fridges and freezers had been hacked and set to 50 degrees Celsius (122 degrees Fahrenheit).
It’s a repeat of an earlier incident that struck refrigeration systems in hundreds of supermarkets and independent stores across France, Belgium and the Netherlands.
Here’s a closer look:
What happened and who was affected
Supermarkets in at least half a dozen European countries, including Sweden, Belgium, Luxembourg, Ireland, Italy and Estonia, reported problems on Monday.
It wasn’t just big chains.
The owner of a butcher shop in Athens told private Greek Skai TV Tuesday that someone hacked into the temperature control of a refrigeration unit, raising the temperature to 150 degrees Celsius (302 degrees Fahrenheit).
George Boubas said his employees who start their shift at 4 a.m. at the shop in the Kifisia suburb first noticed the problem. It took a technician two hours to wrest back control of the unit’s temperature settings, although the meat products weren’t affected, he said.
Boubas said the technician told him that an area supermarket and a fast-food restaurant experienced the same issue.
He said they resorted to switching off the Wi-Fi connection to the refrigeration units to restrict outside access.
Experts said the cyberattacks were a reminder of the risks that come as more things get connected to the internet.
“This attack is a wake-up call. We have filled our homes and shops with devices that are really small computers, yet we still treat them like ordinary appliances,” said Katerina Mitrokotsa, a cybersecurity professor at the University of St. Gallen, in Switzerland.
“A fridge doesn’t look like a security risk, and that’s exactly why attackers like it.”
Fridges are connected to save money and cut waste
The cyberattack mirrors one that happened weeks earlier that affected mainly French and Dutch retailers.
French cybersecurity investigators blamed problems with outdated remote control modules made by Danish company Danfoss as well as U.S.-based Copeland. Danfoss said most affected systems were older products that no longer received software or security updates, while Copeland identified a vulnerability in discontinued controllers.
“Supermarkets connect their fridges so they can monitor temperatures around the clock across hundreds of stores, get alerts before food spoils, cut energy costs and let technicians fix faults remotely,” Mitrokotsa said.
“This saves money and reduces food waste, but every connected fridge is also an entry point that needs to be secured like any other IT system.”
Experts said many businesses are rushing to embrace trendy new technology while neglecting the vast network of connections that they rely on for their daily operations, from payment and ordering systems to warehouses, refrigeration and other building controls.
“Organizations are pouring budget into AI and digital transformation while the systems that keep food cold, water clean, and lights on often run on hardware that has not been funded since installation,” said Nicole Carignan, senior vice president of security and AI strategy at cybersecurity company Darktrace.
“Nobody broke into these refrigeration systems with a zero-day,” she said, using a term for a flaw that has gone undetected by the system’s creators and security reviews. “They got in through internet-facing controllers, end-of-life firmware, and default passwords. That is technical debt coming due.”
British cybersecurity officials on Tuesday shed little light on the latest attack, while pointing to what they called “legacy technology.”
“The cyberattack on French supermarkets was a result of exploitation of known vulnerabilities,” U.K. cyber minister Liz Lloyd said in a speech. “It’s a clear demonstration that poor cyber hygiene, like weak passwords, continues to put organizations at risk.”
Richard Horne, the head of the U.K.’s National Cyber Security Center, told reporters the French fridges were “connected directly to the internet with default passwords.”
A team from the center issued warnings and worked through Monday night contacting organizations that had “vulnerable technology exposed,” he said.
No evidence so far that AI was involved
Advanced artificial intelligence systems from companies like Anthropic and OpenAI have come under fire recently after a string of revelations that they hacked into organizations while evading human control.
Experts, however, said Tuesday that they didn’t think these attacks were powered by AI.
“There is no evidence AI was used, and the techniques did not require it,” said Carignan.
“I think the key element of that is that this wasn’t an AI attack” said Paul Chichester, director of operations at the U.K. cyber center. “This is using vulnerabilities that absolutely have been out there for a long period of time. And that’s where we really need to sort of focus on.”
Who’s behind it and what’s the motive
Investigations have so far failed to discover who might have carried out the cyberattacks and why.
France’s national cybersecurity agency, ANSSI, said it has been investigating refrigeration-system breaches since mid-October and coordinating protective measures with “all sectors that could be affected.”
In a statement to The Associated Press, the agency said it knew of compromised remote refrigeration controllers in Danfoss’s AK-SM and AK-SC ranges, as well as Copeland and Dixell xweb systems.
ANSSI said it was mobilized to assist “potential victims in France” and pointed to a security alert first published Oct. 12, which has been updated regularly.
Italian cybersecurity and intelligence officials were scheduled to meet Tuesday morning to discuss the incident, according to Italian news agency ANSA.
Officials at the European Union’s executive Commission were also holding similar meetings.
European Commission spokesperson Thomas Regnier declined on Tuesday to comment on who might have carried out the hacks, saying that’s up to the bloc’s 27 national authorities to figure out.
Regnier told reporters the incidents “are not isolated” and that Europeans “have to be collectively resilient and prepared for such cyber incidents.”
___
Hadjicostis reported from Nicosia, Cyprus. AP writers Lorne Cook in Brussels, Lefteris Pitarakis in Athens and Thomas Adamson in Paris contributed to this report.
