On November 3, Reuters reported a similar cyberattack spread across Europe, impacting several retailers across the continent.
“The Danfoss controller attacks put a big ‘look here’ sign for malicious hackers onto the refrigeration units; no surprise there are now follow-on copycat attacks that are expanding from the initial attacks,” says John Gallagher, Vice President at Viakoo.
According to Reuters, the following retailers reported cyber incidents impacting their stores:
- Ahold Delhaize
- Carrefour
- Colruyt Group
- Coop
- De Laet & Van Haver
- Edeka
- ICA
- Musgrave
Another Possible Target: Military Bases
Today, a New York Times report has suggested a link between this activity and a series of refrigeration malfunctions that occurred in the summer across U.S military facilities. Officials are now investigating if those malfunctions were instead a part of an offensive cyber operation.
“These attacks demonstrate just how effective a cyberterrorism campaign could be,” warns Louis Eichenbaum, Federal CTO at ColorTokens. “Our adversaries are increasingly targeting the foundational elements of human life: water, electricity, and now our food supply. Even when these attacks fail to cause widespread disruption, they can create fear, undermine public confidence, and expose vulnerabilities in the infrastructure our communities depend on.
“My greatest concern is that we may be witnessing adversaries testing our defenses ahead of something much larger. A coordinated cyberattack targeting multiple critical infrastructure sectors simultaneously could have devastating consequences for public safety, economic stability, and national security. We cannot afford to wait for that scenario to become reality.”
Blood Banks Attacked
Another refrigeration attack hit France, with reports confirming the country’s national blood service was hacked. The hackers increased temperatures on three cold stores holding vital blood products.
Thomas Plank, CEO and Co-Founder of Tributech, comments, “The worrying part isn’t that attackers reached a freezer. It’s that a freezer holding plasma accepted an instruction to heat itself to 110°C. No legitimate operator would ever send that command, so it should have been rejected regardless of who sent it or which system it came through.
“This attack reportedly came through a refrigeration service provider, not the blood service itself. That is the blind spot across critical infrastructure. Third parties hold remote access to physical equipment, and the equipment trusts whatever arrives on that channel.”
How Security Must Respond
Robert Costello, Chief Digital and Information Officer at Merlin Group, warns, “These attacks continue to highlight the fragility of control systems. As the manufacturer highlights, sometimes software updates cannot completely resolve these issues, and the hardware in these systems must be replaced with more modern technologies. There is no simple answer; these systems are often deployed in environments where they operate for decades. While it is possible to employ zero-trust principles to provide some protection, this is not easy and often requires a full rebuild of the environments to achieve results.”
“The lesson is clear, patching alone is not enough,” says Eichenbaum. “Many OT environments rely on legacy controllers that cannot be easily updated or replaced. Organizations must identify exposed assets, eliminate unnecessary internet access, enforce strong authentication, and implement microsegmentation to restrict unauthorized communications and contain compromised systems. Cybersecurity must move beyond simply preventing intrusions to ensuring that essential services continue operating during an attack. That requires comprehensive asset visibility, zero trust access controls, microsegmentation, continuous monitoring, and tested recovery procedures. Ultimately, our adversaries don’t need to steal data to cause harm. They only need to disrupt the systems that sustain our daily lives. Our measure of cybersecurity success must be whether we can contain an attack and keep the mission running.”
Gallagher adds, “Key actions that organizations should take immediately include putting any internet-facing consoles behind firewalls, turn off any remote access controls, update firmware, and rotate passwords. Systems that are end of life should be decommissioned immediately, and remaining systems should be on segmented networks where access can be controlled.”