Poland is the fifth country in the world in terms of the number of internet-accessible and vulnerable supermarket refrigeration systems, according to Forescout analysis reported by „Rzeczpospolita”. Meanwhile, Europe is experiencing a wave of attacks in which hackers overheat fridges and freezers in supermarkets.
What the Forescout Data Shows
According to „Rzeczpospolita”, Forescout analysts identified around 13,000 refrigeration management interfaces worldwide that can be accessed directly from the public internet. The largest share, nearly one in three, is in France. Poland is fifth, behind the USA (approx. 9%), Spain (8%) and Belgium (7.5%). The newspaper reports that Poland has over 6% of such points.
An interface is a control panel through which many fridges and freezers can be remotely altered at once. Taking it over allows the temperature across an entire installation to be raised. It is unknown how many of these devices were actually hacked.
A Wave of Attacks in Europe
In mid-October, hackers struck stores in France. As Cybersecurity Dive reports, another wave followed on Monday, 2 November. Attackers switched controllers to defrost mode, and temperatures in some units reached 50°C, which, according to Dark Reading, caused food to spoil. Affected chains included Carrefour stores in Belgium, ICA in Sweden (23 stores), and Delhaize.
According to Dark Reading, incidents also affected some stores in Poland in October. „Rzeczpospolita” writes about cooling problems at an Auchan store in Olsztyn, but the chain did not comment on the matter. According to the newspaper, attackers also used servers located in Poland in an attack on the Dutch chain Albert Heijn.
The targeted controllers are often older devices, including those from Danfoss, Copeland and Dixell, that lack security updates. The British minister for cybersecurity pointed to outdated technology and weak passwords, as reported by PBS.
What Polish Institutions Did
As TVP World reports, after the attack in France, NASK (the Research and Academic Computer Network) scanned Polish networks and found 140 potentially vulnerable refrigeration devices. Marcin Dudek, head of CERT Polska, confirmed an attack on one device in Poland, which caused no material losses. According to TVP World, around 70 companies disconnected their devices from the internet following expert warnings.
What It Means
Retail chains, wholesalers, food warehouses and processing plants with remotely managed cold storage are primarily at risk. For customers, the risk mainly means empty shelves of frozen and chilled products in affected stores, as well as higher network costs. Experts quoted by „Rzeczpospolita” advise, among other things, removing control panels from the public internet, changing default passwords, enabling multi-factor authentication, updating software, and separating control systems from the rest of the IT network. CERT Polska urges that refrigeration systems not be publicly accessible and that remote access for service technicians be secured.
Łukasz Ozimek of Exea Data Center points out that companies should check whether their insurance policies cover physical damage caused by a cyberattack. Check Point experts warn that this method may be copied by other groups. As of publication, no perpetrators of the attacks have been publicly identified.
