You didn’t need to be a cyber genius to cook the frozen peas in supermarkets across Europe this month.
On November 2, freezers in dozens of stores across at least 11 countries were cranked up remotely, some to 50 degrees. Carrefour and Ikea in Belgium, ICA and Coop in Sweden, Kesko in Finland and SuperValu in Ireland were among those hit. It was a repeat. Three weeks earlier, hackers had done the same to hundreds of French supermarkets.
Security agencies have been warning about this since 2014, when France’s cyber agency, ANSSI, first told operators never to put these controllers directly online. Overnight, French Foreign Minister Jean-Noël Barrot named Iran as the country behind the hacks and called for European sanctions against Tehran, amid broader concerns about Iranian cyberattacks and terrorism.
It sounds innocuous – defrosted peas, carrots and cauliflower – but it should worry Australians. The same controllers, the small computers that set a fridge’s temperature, also run cold rooms in hospitals, medicine warehouses and data centres.
In France, hackers have already reached the cold storage of at least three blood banks, the national blood service said last week. The blood was moved, and no patients were harmed.
Open doors
The French attackers barely had to try. ANSSI chief Vincent Strubel told the French Senate the controllers had been sitting on the open internet with no firewall, their admin screens guarded only by weak passwords.
The second wave looks no more sophisticated. A spokesperson for Danish controller maker Danfoss said the Dutch systems that were hit were not on a secure network and still had their factory passwords. The default passwords for one company’s systems were printed in its manuals, according to Paul Chichester, director of operations at Britain’s National Cyber Security Centre.
On the day of the second wave, at least 1000 Danfoss store systems were exposed online worldwide, according to US security company Claroty. It couldn’t say how many are in Australia.
Sabcobel, Belgium’s refrigeration industry group, says the damage would have been far worse if its members hadn’t started patching the vulnerabilities after October 12. Danfoss said in a statement that most of the equipment that was hit was old and no longer received security updates. That leaves no excuse for operators who left their systems exposed.
Nobody has yet claimed the attacks or asked for money. Tom Hegel, a lead researcher at US security company SentinelOne, says Russian-aligned groups are also credible suspects because they have attacked similar systems before. But that is “only context, not the missing evidentiary link”, he says. Romania’s cyber security director, Dan Cîmpean, called the attacks “semi-amateurish”.
Samuli Bergström, who used to run Finland’s national cyber emergency team and now leads threat intelligence at Finnish security company WithSecure, suspects it is “less about food than about opportunity”. Retailers’ defences are generally weaker than those of banks or energy companies, he told this masthead, and “if the security is poor, someone will find it”.
Who pays
Breaking in is getting cheaper, largely thanks to AI. In August, Claroty published details of security holes in controllers made by Danfoss and US company Copeland. A day after the French attack, its researchers showed an AI tool could build a working attack on those holes, on a test device, in about 28 minutes.
It cost $US6 (about $9).
Luc De Laet, who runs a small butcher chain in Belgium, told Reuters he lost about €15,000 ($24,000) of meat in a single night.
That’s more than 2500 times what the AI test cost.
“A hacked bank is abstract, but an empty shelf is visible within a day and triggers stockpiling that makes things worse,” Bergström says.
Australia’s turn?
No attacks have yet been reported in Australia. Woolworths is understood to have no store refrigeration controllers connected to outside networks, and Aldi is similarly understood not to use outside networks to manage or maintain its refrigeration. Coles did not respond to questions.
Leah Pinto, a director in the intelligence team at Melbourne-based security company CyberCX, says attackers are getting better at hitting the internet-connected gear that runs lifts, air-conditioners and fridges. They are also keener to try, “particularly as criminals experiment with artificial intelligence”.
“Cyberattacks can now be highly disruptive to our daily lives and the broader economy,” she says.
There may be good reasons to connect a fridge. But Bergström says the real question is whether a device needs to be reachable from the internet at all. “If not, it shouldn’t be online.”
Two days after the French attack, the Australian Signals Directorate issued an alert to businesses that run refrigeration and cooling systems.
Australia’s critical infrastructure laws cover the supply networks of grocery giants including Woolworths, Coles and Aldi, but they don’t explicitly cover the freezer aisle. Fridges count only where hacking them could materially affect those networks, and it is unclear whether a single store’s melting freezers would. Home Affairs would not say whether it had spoken to any supermarket about the attacks.
Bergström has a simple test: “If a failure can harm the public within days, it belongs in that category.”
Europe has had two warnings in three weeks. Australia has had two free ones.
David Swan travelled to Finland as a guest of the Finnish Ministry for Foreign Affairs.
The Business Briefing newsletter delivers major stories, exclusive coverage and expert opinion. Sign up to get it every weekday morning.
David Swan is the technology editor for The Age and The Sydney Morning Herald. He was previously technology editor for The Australian newspaper.Connect via X or email.
