Cyber threat actors exploited a vulnerability in refrigeration control panels that impacted multiple supermarket chains across Europe. Threat actors raised the temperature of freezers and refrigerators overnight to 122 degrees Fahrenheit (50 degrees Celsius) . Central control panels are often used to manage multiple refrigeration units. Typically, users opt to control these panels from anywhere, making them accessible over the internet. According to CERT-FR, France’s Computer Security Incident Response Team, operated by ANSSI, the National Cybersecurity Agency of France, an alert bulletin was issued stating, “CERT-FR is aware of numerous compromises of Danfoss AK-SM, AK-SC series remote controllers for refrigeration systems, as well as Copeland xweb and Dixell xweb”. In addition, CERT-FR stated, “In general, exposing a management interface on the Internet is contrary to good practices”. Last month, Team82 Research at Claroty released research detailing vulnerabilities identified in Danfoss AK-SM 800A controllers. Danfoss stated that the affected units “were running outdated firmware” and the company “long advised customers to keep supported systems updated with the latest firmware and to migrate legacy systems to current-generation solutions."
This cyberattack is similar to an incident that occurred in which at least six United States military commissaries experienced refrigeration outages in late August. The Defense Commissary Agency manages 235 stores worldwide, and an official stated that the department is aware of “possible refrigeration disruption at some Defense Commissary Agency commissaries.”
Additionally, on October 12, Ahold Delhaize issued a statement regarding a cybersecurity incident impacting their network, requiring some systems to be taken offline. Ahold Delhaize is a food retail group that operates e-commerce and supermarkets across Europe, Indonesia, and the United States. The US stores include Food Lion, Giant Food, Hannaford, Stop & Shop, and the Giant Company. As of October 14, Ahold Delhaize is still working to mitigate the incident and restore certain systems.
The Food and Agriculture sector is one of the largest and most critical infrastructure sectors in the United States. The sector has adopted a significant technological transformation through the addition of industrial control systems (ICS), operational technology (OT), Internet of Things (IoT) devices, cloud-based management platforms, and advanced supply chain management systems. These technologies improve efficiency, productivity, and sustainability, but also increase the sector's cyberattack surface. The integration of information technology (IT) and OT, combined with limited cybersecurity resources among many organizations, continues to create opportunities for threat actors seeking to exploit vulnerabilities throughout the food supply chain.
Recommendations
- Immediately audit and remove all direct, public-facing IP connections to centralized refrigeration controllers.
- Require all remote connections to route through an encrypted VPN or ZTNA tunnel.
- Physically and logically isolate building automation systems, refrigeration units, and environmental controls from corporate IT networks.
- Automate periodic network scanning to detect shadow IT, misconfigured cellular modems, or newly exposed store controllers.
- Establish dedicated maintenance windows to deploy vendor security patches.
- Implement a prioritized replacement plan for legacy controllers that have reached hard end-of-service/end-of-life status.
- Install secondary out-of-band temperature sensors operating on isolated networks, separate from primary control panels, to provide real-time alerts if temperatures drift outside safety thresholds.
- Integrate electromechanical high-limit thermal switches into defrost heater circuits.
- Limit third-party refrigeration technicians and equipment vendors to set access windows.
- Develop and train facility managers to manually decouple network interfaces and override refrigeration racks using local mechanical or analog bypass switches.