European reports of supermarket refrigeration cyberattacks have prompted scrutiny of remote access safeguards, with Carrefour Belgium reporting minor effects at 15 stores and the Dutch agency investigating incidents across the region.
Carrefour Belgium said in a Nov. 2 statement that a cyberattack on refrigeration equipment had minor effects at 15 of its more than 700 Belgian stores. No hypermarkets were affected, and every location remained open when the company issued its statement. Most of the disruption involved specific equipment serving frozen-food areas.
The Netherlands’ Nationaal Cyber Security Centrum (NCSC) said it was monitoring and investigating attacks on cooling installations from different suppliers, including in the Netherlands. The agency warned that anyone who gains access could alter cooling temperatures or defrost schedules, risking spoiled products, food-safety problems and business disruption. It cited equipment reachable through the public internet and weak or default passwords as possible openings, but did not identify those as the method used in the current cases.
Secomea A/S, a Danish industrial cybersecurity company that sells secure remote-access tools, said network links help service teams monitor refrigeration equipment across multiple stores. The company urged retailers to restrict each user’s permissions to the equipment they need and keep records of activity on those connections. “When attackers interfere with operational technology, the consequences become physical,” Secomea CEO Michael Ferdinandsen said.
In France, Economy Minister Roland Lescure told the National Assembly on Oct. 13 that 700 of 10,000 retail sites had been affected, while the country’s food supply remained secure. The French Computer Emergency Response Team (CERT-FR) listed compromises involving Danfoss AK-SM and AK-SC controllers and Copeland xweb and Dixell xweb systems in an alert issued Oct. 12 and updated Oct. 16. It advised operators to remove refrigeration controls from direct internet access, review their configurations and use a secure virtual private network or another protected route for necessary remote connections. The NCSC said its investigation into the European attacks is continuing.
