UK cyber agency reports impacts as European refrigeration hacks widen

The UK's National Cyber Security Centre is aware of a couple of instances in which vulnerable technology was exploited in Britain, according to updated BBC reporting on refrigeration hacks across Europe. Chief executive Richard Horne said the agency worked overnight to warn potentially affected organisations. The acknowledgement updates its earlier position that it knew of no UK impact.¹

Infographic

Enlarge

Investigation and store losses

BBC reporting describes an overnight hack targeting hundreds of stores and spoiling fresh and frozen food worth millions of euros. It also describes attacks on supermarkets and food suppliers in France in October and reports of rising refrigerator temperatures in Ireland, Sweden, Estonia and Belgium on Monday. These figures do not establish a combined total of affected European locations.¹

According to a November 3 report from Xinhua, Belgian federal prosecutors began a criminal inquiry after attacks hit no fewer than 76 supermarkets and other retail locations. Ikea said its store in Mons was affected, according to both Xinhua and The Japan Times.⁴³

Individual chains gave more detailed accounts. According to GMA News Online, Carrefour reported problems at 15 of its 700 Belgian stores, while Colruyt Group said refrigeration systems at five shops had been attacked. In Sweden, Coop reported unauthorised interference at seven of its 800 stores.²

Musgrave said affected systems at 13 SuperValu stores required chilled and frozen goods to be taken off sale, GMA reported. The same report described losses of about €15,000 in meat at Belgian butchery chain De Laet & Van Haver after refrigerator temperatures rose as high as 18C.²

Responsibility remains unresolved

A Belgian refrigeration executive said the attacks switched equipment into defrost mode remotely, according to Xinhua. Separately, GMA reported that Danfoss was helping customers apply fixes after its temperature-control technology was targeted.⁴²

GMA reported that police had described hackers taking control of cooling equipment at hundreds of French supermarkets, causing fires and food losses. But it remained unestablished whether Monday’s incidents were connected to France, or who was responsible. No one had claimed responsibility for either attack, the outlet reported.²

Katrien Eggers, who speaks for the Belgian Centre for Cybersecurity, warned that the person or group behind the attacks might never be identified. The Japan Times described the incidents outside France as apparently smaller in scope, potentially involving dozens of locations; Xinhua separately reported at least 76 affected retail outlets.²³⁴

Connected equipment under scrutiny

The BBC now reports that the NCSC knows of a couple of UK instances in which vulnerable technology was exploited, updating its earlier account of no known British impact. Chief executive Richard Horne said the agency worked overnight to alert potentially affected organisations; it warned handfuls of bodies and knew of a couple of impacts. Separately, UK Cyber Defence researchers found more than 800 publicly accessible refrigeration and building-management interfaces associated with British retailers.¹

According to the BBC, attackers exploited vulnerabilities in systems used to control refrigeration remotely that cybersecurity researchers had disclosed months earlier. Horne said many firms had continued using technology beyond its supported life, failed to upgrade it or failed to isolate it from the internet. He urged organisations to invest in renewing the technology they depend on.¹

Such access does not by itself establish that equipment can be compromised, the BBC noted. Its report also said there was no evidence that household appliances had been targeted. SentinelOne researcher Tom Hegel said retailers needed to establish responsibility for equipment security, rather than focus only on maintenance.¹