What we know so far: Last month's cyberattack on French grocery store refrigerators became an expensive reminder of the risks of relying on the Internet of Things for critical infrastructure. New attacks this week show that several European countries face the same vulnerabilities, with lax security practices and obsolete systems the likely culprits.
A cyberattack on internet-connected refrigeration systems ruined food at grocery stores in at least seven European countries on Monday, with one Belgian Delhaize store estimating its losses at €100,000. The attack mirrors the one that hit French grocers in mid-October, exposing gaping security holes.
Grocery stores and chains in Ireland, Luxembourg, the Netherlands, Belgium, Sweden, Finland, and Estonia reported that refrigerators had been set to defrost, in some cases raising temperatures to 50 degrees Celsius (122 degrees Fahrenheit), spoiling food and leaving many shelves empty. The French attack set cooling systems to the same temperature and caused damages estimated in the tens of millions of euros.
An ICA store manager in Stockholm told Reuters on Monday that employees didn't notice the attack, which hit at 2am local time, until hours later, by which point "everything" was destroyed. Other targeted businesses include Delhaize in Belgium and Luxembourg, Carrefour and De Laet & Van Haver in Belgium, Coop in Sweden, and more.
It remains unclear who was responsible for the attacks. No one has claimed responsibility, and at least some affected stores have security vulnerabilities so deep that practically anyone could have accessed their systems.
The refrigerators attacked in France were operated by Danfoss, and the incident came two months after security researchers at Claroty warned of multiple vulnerabilities in the company's controllers. Danfoss also supplied the affected units in at least some of Monday's attacks, though Belgian installer Sabcobel, which operates Delhaize's refrigeration, was also involved.
Security researcher Kevin Beaumont says several thousand Danfoss management systems are directly reachable from the internet with essentially nonexistent login security. In his words, the username is "admin" and the password changes daily to the current date. Claroty's research points to a hidden daily code derived from the date that bypasses the real password, a flaw Danfoss has since patched.
Furthermore, many affected systems were running outdated firmware, and some can't receive patches at all because they are end-of-life, a common risk with IoT devices. Shodan.io shows thousands of exposed Danfoss units, more than half in France, with others in South Africa and elsewhere.
Whether a sophisticated state actor or a bored individual was behind the attacks, they serve as another lesson in IoT pitfalls. Some also fear that similar incidents could form part of a broader effort to destabilize a country's infrastructure.