A butcher near Antwerp lost €15,000 worth of meat in one night. Freezers in Estonia, Ireland, and Sicily heated up too. As the fridge hacks spread to ten countries, Brussels calls them a deliberate attempt to disrupt Europe’s food supply. Who is behind them remains a mystery.

The damage from Monday’s attack turned out to be far wider than it first looked. Supermarkets in Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Romania, and Sweden reported problems with their cooling systems. On Monday morning, the first reports came mainly from Sweden and Belgium. Overnight, attackers remotely raised the temperature settings or switched the units into defrost mode.

In Ireland, retailer Musgrave pulled chilled and frozen food from 13 SuperValu stores. The attack also hit at least four Coop supermarkets in Sicily. At a Selver store in Estonia, someone set a freezer to 50 degrees Celsius. Staff spotted it within about 10 minutes and saved the food. Luc De Laet, a butcher in Hove south of Antwerp, was less lucky. He estimates the attack cost him about €15,000 worth of meat.

Brussels calls it deliberate

The EU has hardened its tone. Commissioner for Agriculture and Food Christophe Hansen said on Monday that the bloc took the incidents “very seriously”. Three weeks ago, after the attack in France, he spoke more generally about the risks to food security. Now he openly describes the hacks as an intentional strike on the food chain.

On Tuesday morning, the European Commission moved to coordinate the response. It convened two meetings. The first gathered the EU Interinstitutional Task Force, including the European Union Agency for Cybersecurity (ENISA) and Europol. The second brought together national authorities, including those from the affected countries, within the European Cyber Crises Liaison Organisation Network (EU-CyCLONe). The network exists to manage large-scale cyber crises.

Commission spokesperson Thomas Regnier told journalists that national authorities were leading the investigations. He refused to name a suspect. “It is not for us from this podium to attribute such cyber incidents,” he said. When a reporter asked about Russia, he again declined to speculate. He did, however, admit that these were not isolated incidents.

National authorities are no closer to an answer. Belgium’s federal prosecutor opened a criminal investigation. The country’s Centre for Cybersecurity said the attackers might never be identified. In Italy, the government scheduled a cybersecurity meeting with its intelligence services for Tuesday.

Old controllers, default passwords

What links the cases is ageing technology. Many affected stores used refrigeration controllers from Danish manufacturer Danfoss, the same supplier involved in France. In Estonia, attackers got into an older Danfoss system. In the Netherlands, a Danfoss spokesperson said the hacked systems sat outside a secure network and still used default passwords. A Belgian butcher reported that equipment from a second maker, Copeland, was also targeted.

The warnings were there. In October, France’s national cybersecurity agency issued an alert about the vulnerable controller models. Danfoss told Dutch customers to disconnect their systems from the internet. Many shops listened. The attackers found the ones that did not.

They are a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it.
— Christophe Hansen, Commissioner for Agriculture and Food

Fixing the problem will not be cheap. Stephan Moelans, head of Belgian refrigeration contractor Sabcobel, says a software update alone is not enough. Many installations need physical changes, and those cost money. For Brussels, however, the stakes go far beyond a few spoiled freezers. “They are a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it — a warning that we must take seriously,” Mr Hansen said, according to AFP.