Cyber incidents disrupted refrigeration at 28 supermarket stores in Belgium and Ireland on Nov. 2, forcing one grocer to pull chilled and frozen goods while the other kept its locations open.
Carrefour Belgium said 15 of its more than 700 stores were affected, mostly around frozen-food sections. No hypermarkets were involved, and the retailer said every outlet stayed open. Musgrave Group told The Irish Times that a cyber incident impaired refrigeration in 13 SuperValu stores. The company temporarily took chilled and frozen items off shelves while it addressed a problem involving a particular refrigeration model; it later said the issue was fixed and the affected stores were back to normal.
In France, the government’s computer emergency response team, CERT-FR, documented multiple intrusions into remotely managed refrigeration controllers in an alert issued Oct. 12 and updated Oct. 16. The affected equipment included products made by Danfoss, Copeland and Dixell. No connection has been established between the French compromises and the Belgian or Irish incidents.
Central controllers let staff monitor and adjust multiple cooling units remotely. Cybersecurity firm Claroty said exposed management access can allow intruders to change temperatures, schedules and alarms. Claroty disclosed vulnerabilities in some Danfoss and Copeland systems in August. At an Oct. 21 hearing, France’s National Cybersecurity Agency (ANSSI) Director-General Vincent Strubel said the agency’s analysis pointed to internet-exposed equipment, weak passwords and other basic security failures. He said published software flaws did not appear to have been used in the French attacks. CERT-FR advises operators to remove internet access, check settings and route remote connections through protected networks.
A separate incident in Israel shows how tampered controls can damage equipment. Incident-response firm Profero said attackers altered controls at a food-production plant in May, destroying three compressors and keeping the upgraded refrigeration system out of normal service for nearly a week. Profero attributed the operation to Cyber Isnaad Front; its report does not connect the group to the European incidents.
In August, the U.S. Defense Department said it was aware of a possible refrigeration disruption at some military commissaries. Reuters later reported that officials were treating the outages as a suspected cyberattack. The Army Criminal Investigation Division said its Cyber Field Office was working with French law enforcement, but no cyber cause has been confirmed for the U.S. outages.
