Cyberattack on Supermarkets Raises Concerns Over Food Security in Europe
Supermarkets in France and the Netherlands are grappling with the aftermath of a cyberattack that severely disrupted refrigeration systems. France's cybersecurity authority has issued a warning that the attack may still be ongoing, as stores worked to restock their shelves after the incident caused refrigerator temperatures to rise dangerously high, raising concerns about the integrity of food supply chains.
The agency reported that the attacks were likely still in progress and advised stores to reconnect their refrigeration units to the internet only through secure VPN connections or protected networks. They also recommended installing firmware updates and changing passwords to enhance security.
In the early hours of Monday, attackers gained remote control over refrigeration systems in hundreds of supermarkets and independent stores across France. Temperatures soared to 50 degrees Celsius (122 degrees Fahrenheit) for approximately six hours, forcing many stores to discard large quantities of fresh and frozen goods. The Intermarché supermarket chain reported losses amounting to tens of millions of euros in just one day.
In the Netherlands, a major supermarket chain began restarting systems that had been shut down as a precautionary measure following what its parent company, Ahold Delhaize, described as a cybersecurity incident. This incident disrupted home deliveries and affected supplies to its extensive network of stores across the country.
Authorities in both France and the Netherlands are currently investigating the cyber incidents, which have exposed vulnerabilities in older refrigeration management systems and the efficiency of the countries' food supply chains. The Dutch National Cybersecurity Center noted that several cyber incidents had impacted Europe's food sector but stated there was no evidence linking these incidents together.
Europol, the European Union's police agency, confirmed it is in contact with authorities in the affected countries but has not disclosed further details due to the ongoing investigation. As of now, no perpetrators have been publicly identified, and no claims of responsibility have been made.
François Deruty, a former operations director at the French Cybersecurity Agency, suggested that the attackers could range from sophisticated state-sponsored actors to individuals seeking to exploit the situation. He noted the timing of the attack coincides with ongoing protests in France regarding educational conditions, adding another layer of complexity to the situation.
Impact on Fresh Produce and Supply Resilience
A timely alert helped save some fresh produce at one supermarket, but many frozen items were lost due to the temperature spike. In the Netherlands, empty trays typically filled with fresh tomatoes were seen in stores, although staff were actively restocking shelves with other products.
Experts have pointed out that the reliance on just-in-time deliveries in supermarkets makes them particularly vulnerable to disruptions. A recent report recommended that Dutch households maintain a food reserve sufficient for eight days, exceeding the current government recommendation of a three-day stockpile.
French Finance Minister Roland Lescure confirmed that around 700 of the country's 10,000 supermarkets were affected by the attack. While he assured that there is no immediate risk to France's overall food supply, he acknowledged the incident as a significant threat to food security, calling it a wake-up call for all stakeholders involved.
Deruty emphasized that the vulnerabilities exploited in this attack were foreseeable and that many operators had failed to update their systems with necessary security patches. Despite increased awareness of cyber risks, there remains a gap in understanding among some store operators regarding their vulnerability to such attacks.
The French cybersecurity agency has noted numerous compromises involving refrigeration system control modules made by Danish company Danfoss and U.S.-based Copeland. Danfoss indicated that many affected systems in France were older models that no longer received software or security updates, and it is collaborating with impacted customers to mitigate the damage.
Final Assessment
In an August report, U.S. cybersecurity firm Claroty identified vulnerabilities in the Danfoss AK-SM 800A and Copeland XWeb Pro platforms, which are commonly used in managing refrigeration infrastructure. Claroty highlighted that many controllers using the Danfoss system were accessible from the public internet, making them susceptible to cyberattacks. However, it noted that both Danfoss and Copeland have since addressed these vulnerabilities.
Copeland confirmed that a vulnerability had been found in a discontinued generation of controllers and is working with affected customers to resolve the issue.
