Groups claim the attacks
The pro-Russian groups Noname057(16) and Z-Pentest Alliance claimed the attacks in a video posted on social media, a claim Tg1 reported on 4 November. In the message, they say no malware was needed and that only built-in systems were exploited, and they claim their reach extends to water supply, power plants, industrial sites and food storage facilities. To back the claim, they published 2,500 lines from a Danfoss database on Telegram, including login data and passwords, according to De Morgen and 7sur7. Their Telegram channels have since been taken offline and their posts deleted, so the claims cannot be independently verified.
How the attacks spread
Hackers reportedly switched the evaporators of refrigeration units to defrost mode remotely, warming cold rooms and display fridges, according to De Morgen and 7sur7. The flaw is said to lie in the temperature-control systems supplied by Danish manufacturer Danfoss. Adnkronos reports that temperatures reached as high as 50 degrees. On Monday, 2 November, cooling systems in supermarkets in Belgium, the Netherlands, Luxembourg, Sweden, Finland, Estonia and Ireland were hit. On Tuesday, 3 November, Germany, Romania and the United Kingdom were added to the list, according to Deutsche Welle. That outlet also recalls that hundreds of supermarkets in France had to discard perishable products in October because of refrigeration failures, in what appears to have been a similar hacker action.
- Hundreds of supermarkets in France discard perishable food after refrigeration failures
- Cooling systems in seven European countries are hit, according to De Morgen and 7sur7
- Germany, Romania and the United Kingdom are added to the list of affected countries
- Tg1 reports that Noname057(16) and Z-Pentest claim the attacks in a social media video
Officials and the impact
In Italy, Palazzo Chigi said after a meeting between undersecretary Alfredo Mantovano and agriculture minister Francesco Lollobrigida, attended by the head of the national cybersecurity agency and the intelligence agency directors, that there was no alarm but maximum attention. The government said the impact in Italy was strongly limited, affecting a few commercial units out of thousands nationwide, mostly with outdated security systems and interfaces exposed directly to the internet. Early reports had cited 20 affected establishments, according to Deutsche Welle. In the UK, Paul Chichester, director of operations at the National Cyber Security Centre, said the meat processing industry was hit and that the impact was minimal. The centre's director, Richard Horne, told the BBC that the problem affected the entire UK food supply chain and that teams worked through the night to warn companies at risk.
Germany, Romania and Belgium
In Germany, the refrigeration of a supermarket run by the charity Arbeiterwohlfahrt in Wetter-Volmarstein, North Rhine-Westphalia, was attacked. Temperatures rose in the display fridges and outdoor storage areas, and the store had to throw away large quantities of food. The extent of the damage is still unclear. Sandrae Salten, head of the organisation, said the hackers' real target appeared to be the company that carries out remote maintenance of the refrigeration systems. Deutsche Welle counts four affected supermarkets in Germany and six in Romania, according to authorities and company representatives. In Belgium, dozens of stores from several chains reported cooling failures, and the federal prosecutor's office opened an investigation.
Who is behind it
Researchers at several firms are analysing data from honeypots, decoy systems designed to look vulnerable and lure attackers. According to the BBC, three firms deployed fake freezer-software traps, and experts do not rule out Russian groups, while also naming Iranian hacktivists, nation-state hackers or teenagers as possibilities. Lupovis, a firm based in Strathclyde, saw activity on its honeypots starting 10 days before the second wave, and its decoys, located around the world, were probed only from Europe. Ryan Dewhurst of the Spanish company Previdian said the simultaneous hits point to planning.
The fact that all these fridge freezers were hit simultaneously suggests planning and coordination.
Eric Schouten, a former AIVD officer, told AD that the claims could well be correct, given the groups' record of attacks on water treatment plants, energy supplies and industrial control systems. He added that the perpetrators have not yet been independently identified, and that this does not mean the Russian state ordered the attacks.
Root cause
Christoph Fischer, an IT security expert from Karlsruhe, places primary responsibility on the makers of connected devices. He said it was a serious failure that control systems are shipped with factory settings and standard passwords, and that operators should have received manufacturer updates requiring those default access details to be changed. He also warned against limiting the problem to grocery retail, noting that connected technology is found in photovoltaic systems and heat pumps, and that private appliances are increasingly connected without need.
"This is completely unforgivable," Fischer said of the default settings.
It doesn't all have to be on the internet.
European Commission spokesman Thomas Regnier said EU agencies are in contact with national authorities to prepare a coordinated response, and that the incidents are not isolated. Belgian federal prosecutors have opened an investigation, and the perpetrators have not been independently identified.