Danfoss

Summary

Danfoss refrigeration controls were among the systems targeted in a hacking spree that raised temperatures in supermarket refrigeration units across Europe, spoiling tonnes of food and affecting grocery chains in Germany, Romania, the United Kingdom, and multiple other countries. The attacks also compromised cold storage units at blood banks in France, though officials reported that no blood products were damaged and no patients were harmed. Authorities described the incidents as connected rather than isolated, with the motive still unknown and no group claiming responsibility.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Hackers raised the temperatures of refrigeration systems at supermarkets in Germany, Romania and the United Kingdom during a wave of cyberattacks that affected at least eleven European countries. The incidents were part of a broader hacking spree that spoiled tonnes of food across the continent and was described by European Union officials as not isolated. Problems were first reported in at least nine EU countries on Monday, including Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden. On Tuesday, officials and company representatives confirmed that four supermarkets in Germany and six in Romania were affected, while the United Kingdom, which is not in the EU, was also hit. Danfoss, a Danish maker of refrigeration controls, confirmed that its systems were again among those targeted in the attacks. The company stated that it had been in close contact with customers for the past three weeks. The second wave of attacks mirrored a previous cyberattack that swept hundreds of supermarkets across France in October and also affected stores in several other European countries. In Sweden, the supermarket chain Coop reported that refrigerators and freezers affected overnight at seven of its stores had been connected to old 4G networks, and that the stores had since resumed normal operations. Coop said it had accelerated an upgrade, begun after the October attacks, to move its connected refrigeration equipment onto 5G networks and modern modems. Belgian authorities reported that dozens of stores across several grocery chains experienced refrigeration failures, and federal prosecutors there opened an investigation.

In Italy, about twenty supermarkets were affected, including four of three hundred stores operated by a group running Coop supermarkets in Sicily, causing thousands of euros in damage and forcing the disposal of spoiled goods. Italian government officials held talks with the heads of the intelligence services and the National Cybersecurity Agency after the attacks, and the Prime Minister's office said the incident had a limited impact. In the UK, hackers attempted to target small meat-processing firms, but the impact was minimal according to the chief executive of the National Cyber Security Centre, who noted that the issue affected the whole food supply chain and that there had been a couple of instances where vulnerable technology had been exploited. French authorities reported on Wednesday that cold storage units in at least three blood banks had also been hacked. The French Blood Establishment stated that fridges housing blood products awaiting delivery to healthcare facilities had been targeted and that temperature and defrost thresholds were set to excessively high levels. Monitoring and alarm systems enabled the rapid identification of these anomalies, and the affected equipment was either brought under control. The blood products were moved to other facilities, and none was damaged and no patients were adversely affected. Technical teams stepped up monitoring of all equipment and were working with the French National Cybersecurity Agency and the Ministry of Health. The motive for the cyberattacks remained unknown, and no one had claimed responsibility. Romanian officials said they did not suspect a state actor, describing the activity as semi-amateurish and stating that no other infrastructure was compromised.

Sources

Sources available to members: 1 source.