Cyberattack on Belgian Supermarket Refrigeration Systems Exposes Critical IoT Vulnerabilities

A cyberattack has compromised refrigeration systems at dozens of Belgian supermarkets, forcing retailers to discard approximately €100,000 worth of perishable goods.

The incident affected around 40 Delhaize locations, at least 15 Carrefour stores, five Spar outlets, and the butchery group De Laet en Van Haver. Belgian media reported that refrigerator temperatures surged as high as 70°C. A Delhaize spokesperson confirmed to Euronews that the company had “identified an IT incident affecting the refrigeration systems in several dozen stores.”

Similar disruptions were reported at several stores operated by the Swedish chain ICA. The attack follows a comparable incident on October 12, when hundreds of French supermarkets experienced tampering with their refrigeration infrastructure.

Why Are Refrigeration Systems Connected Online?

Large-scale supermarket refrigeration networks rely on central management units that regulate temperatures, defrost cycles, and alarm systems for every chiller and freezer in a facility. Connecting these controllers to the internet has long been a standard configuration option, according to research published in October by cybersecurity firm Forescout. This connectivity allows refrigeration contractors to diagnose faults and adjust settings remotely, eliminating the need to dispatch technicians to individual locations.

Danfoss, a leading European supplier, states that internet-connected refrigeration controls typically reduce unnecessary engineer callouts by 15 to 30 percent, since issues can be resolved remotely. The company also notes that remote monitoring enables supermarkets to maintain the temperature logs required by food safety regulations automatically, rather than relying on staff to manually check each cabinet up to four times daily.

Manufacturers’ own installation guides detail how to make these systems accessible externally, such as by configuring store routers to forward internet traffic to the refrigeration controller. The problem, Forescout researchers found, is that responsibility is frequently fragmented. A contractor may manage the software, the retailer may own the hardware, and the store’s IT department may oversee the internet connection. Unless roles are explicitly defined, “no single party may have complete visibility into the exposed service.”

Compounding the issue, some equipment is outdated. One Danfoss controller implicated in recent breaches has been out of support since May 2021, meaning it no longer receives security patches and remains vulnerable to external exploitation.

Assessing the Scale of Exposure

Using Shodan, a search engine that indexes internet-connected devices, Forescout identified 12,976 exposed refrigeration management services across 6,017 IP addresses in 99 countries and territories. The majority belonged to two product families: Copeland and Dixell’s XWEB systems (7,075 instances) and Danfoss’s StoreView platform (4,697 instances).

Of the Danfoss services detected, 80 percent were running firmware versions older than the release that addresses known security flaws. These figures represent exposed systems, not confirmed compromises.

The risk extends well beyond supermarkets. Identical systems are deployed in food processing plants, wineries, fruit storage facilities, farms, and hospital cooling infrastructure. Attackers do not require sophisticated malware; once inside, they can leverage the system’s legitimate functions to alter temperatures, trigger defrost cycles, or disable alarms. Forescout notes that such manipulations can appear indistinguishable from routine operational activity.

Recommended Mitigation Measures

Forescout’s primary recommendation is to remove refrigeration management systems from the public internet entirely, granting contractors access only through secure remote access solutions. The firm further urges operators to replace equipment that no longer receives security updates, eliminate shared contractor credentials in favor of individual logins protected by multi-factor authentication, and maintain detailed audit logs of all configuration changes.

Source link