Attackers remotely heated fridges and freezers at stores in Belgium, Sweden and Estonia. Older, poorly secured controls were the target, and businesses should check theirs.
Overnight into Monday, November 2, attackers remotely changed the settings on refrigeration controls at supermarkets in Belgium, Sweden, Estonia and other European countries. Fridges and freezers warmed up. Some stores threw away chilled and frozen food or pulled it off the shelves. No chain reported more than several dozen affected stores.
Refrigeration controls are small computers that run a store's cooling. They can be connected to the internet so contractors can watch them and fix faults from afar. That same connection let the attackers in.
In Belgium, units were switched into defrost mode. It is meant to clear ice, but here it made the units heat up. In Sweden, an ICA store in Sjöbo said its fridges and freezers were set to 50°C. At a Selver store in Estonia, a freezer was also set to 50°C, but it warmed only about 2-3°C and was fixed in about 10 minutes, with no products damaged.
A butcher shop in Hove, near Antwerp, saw its fridges turned up as high as 18°C. The owner estimated that about €15,000 worth of meat was ruined. Musgrave took products off sale at 13 SuperValu stores as a precaution, and said the incident was resolved and restocking was under way.
Danfoss, a Danish maker of refrigeration controls, said its products were involved. They were also involved three weeks earlier, when attackers hit hundreds of French supermarkets. France's cybersecurity agency, CERT-FR, names these products in its alert:
CERT-FR says attacks on these devices are probably still underway. Danfoss said most units hit in France were older models it no longer updates, the AK-SM 800 and AK-SC 355.
The weak spots were basic. Danfoss told Dutch media that the systems hit there were not on a secure network and still used default passwords. It also said the problem lies mainly in outdated software. In Estonia, the target was an older controller that had not been updated. Sabcobel, a Belgian contractor, knows of about 20 affected units among the hundreds it manages. Many stores had secured their connections after the French attack, but not all.
Fixing it is not always simple. Sabcobel's chief executive said a software update alone is not enough, because some installations need physical changes that cost money. CERT-FR warns that old devices no longer getting security fixes are very likely to be taken over if they stay on the internet, and that a factory reset alone leaves them open again.
The alert box above lists the steps. The short version: know which of your cooling controls are online, take them off the open internet, and replace any model that no longer gets updates.
No one had claimed the attacks by Monday night. It is not known whether they are linked to the French attacks, though Danfoss, Sabcobel and Kitman each described a similar method. When The Hacker News checked on November 3, Danfoss's security advisories page listed nothing about these attacks. Belgium's cybersecurity center had no further information, and Sweden's did not say how attackers got in.
If your fridges or freezers are controlled over the internet, find out how they are connected and whether the maker still updates them.
The Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone callsScammers are posing as Texas sheriff's officers and claiming you missed jury duty. Caller ID can show a real police number even when the call is fake.
Read more: Fake jury duty calls spoof a real Texas sheriff's phone numberFake PayPal emails and texts, some posing as a security report, try to get you to tap a link and type your login. Checking your account directly avoids the trap.
Read more: Got a fake PayPal message? Skip its link and check your account yourself
