Attacks on store refrigeration units have reached Poland, 140 devices vulnerable
Hackers remotely raised temperatures in supermarket refrigerators in at least nine EU countries. In Poland, the first successful attacks have been confirmed, and the Ministry of Digital Affairs says it will disclose the names of companies that fail to secure their equipment.
On the night of November 1 to 2, hackers took control of refrigeration equipment in supermarkets in at least nine European Union countries: Belgium, Sweden, Finland, Ireland, Estonia, Portugal, Italy, the Netherlands, and Luxembourg. Problems were reported by Carrefour, Colruyt, Ahold Delhaize, ICA, Coop, SuperValu, and Intermarché, among others. In some refrigerators and freezers, the temperature reached around 50°C, and the goods had to be disposed of.
This is the second wave of such incidents. On the night of October 11 to 12, similar attacks affected around 700 French supermarkets. The French cybersecurity agency ANSSI initially pointed to controllers made by Denmark's Danfoss, and later also to Copeland and Dixell systems. However, on October 21, its head reportedly told French senators that the issue was more likely internet-exposed admin panels and weak passwords than a specific vulnerability. On November 4, the European Commission, the EU cybersecurity agency ENISA, Europol, and national CSIRT teams (computer security incident response teams) issued a joint call to urgently secure the infrastructure.
CERT Polska, the incident response team operating within the state institute NASK, confirmed successful attacks on devices in Poland. Sources give different numbers: according to Spider's Web, at least two; according to Interia and Portal Spożywczy, one. Auchan Polska admitted that irregularities in refrigeration control occurred in Olsztyn, Częstochowa-Poczesna, and Sosnowiec. Minister of Digital Affairs Krzysztof Gawkowski said on TVN24 that 140 refrigeration devices vulnerable to remote shutdown or temperature changes had been detected in Poland. According to CERT Polska head Marcin Dudek, this number comes from network scanning conducted by NASK. Most companies disconnected these devices from the internet. As for the rest, the minister announced: “we will name you publicly”.
The pro-Russian groups NoName057(16) and Z-Pentest claimed responsibility for the attacks on Telegram. No state institution has confirmed this, and experts remind that these groups have previously falsely claimed similar actions.
CERT Polska recommends not exposing such devices directly to the internet and changing default passwords. Check Point experts additionally point to a lack of software updates. For companies in every industry, this means that refrigeration units, air conditioning, access control, and building automation connected to the network are part of the IT infrastructure and require the same level of oversight as computers.