European supermarkets rush to patch vulnerabilities after region-wide fridge hack

By Louise Rasmussen, Helen Reid and Marcus Mathiesen

COPENHAGEN/LONDON, Nov 3 (Reuters) - European supermarkets targeted in a second wave of cyberattacks that cranked up fridge and freezer temperatures were rushing on Tuesday to upgrade their systems and protect themselves against further hacking attempts.

Stores in eight European countries were forced to throw away vast quantities of food after hackers tampered on Monday with their fridges, in an attack identical to one that swept dozens of supermarkets in France three weeks ago.

In Sweden, supermarket chain Coop said it was switching systems to 5G networks and modern modems, instead of 4G connections - a process that had already started since the French incident.

The seven stores hit by the attack are back up and running but their refrigeration systems have been disconnected from the internet, a spokesperson said.

"We are looking quite thoroughly and deeply into the status of the entire network of stores to see if we risk any vulnerability anywhere in the entire network," the spokesperson added.

Software provider Danfoss, whose systems were again among those targeted, said it has been in close contact with customers over the past three weeks to help them manage the situation, and recommended that systems should not be directly accessible via the internet.

“Retailers need to act now. They should identify whether their refrigerator controllers are vulnerable, check if they are connected to the internet, ensure they've got the latest security updates and are supported by the manufacturer. And if they don’t even know, then remove them from the public internet immediately,” said Frank Groenewegen, cybersecurity expert at Deloitte in The Hague.

“With disconnecting, you haven’t fixed the root cause but you’ve at least isolated those systems so that an attacker is not able to do this anymore.”

'HEIGHTENED ALERT'

Many European supermarkets are run by independent business owners in a cooperative structure, meaning systems are not the same across stores.

Swedish grocer ICA said all 23 stores hit in Monday's cyberattack had equipment connected outside the chain's centrally managed store network.

ICA store owner Christian Olofsson said he felt even more frustrated about the cyberattack given he was in the process of changing the security systems at his stores in Tomelilla and Sjobo in Sweden when they were hacked.

A Swedish police spokesperson said around 10 police reports had been filed since Monday and they expected more.

German supermarket operator Edeka, which had fridges hacked at a store in Reisbach, Germany, told Reuters there are no standardised refrigeration systems across its network of stores run by independent retailers.

Even integrated supermarket groups were not immune: Carrefour, which had 80 franchised stores in France hacked three weeks ago, suffered the same cyberattack again at 15 stores in Belgium on Monday.

EU cybersecurity agency ENISA said the large-scale nature of the cyberattacks targeting retail across several member states "underscores the importance of European cooperation, rapid information-sharing and coordinated responses to cyber incidents".

In Britain, hackers tried to target small meat-processing firms but the impact was minimal, said Richard Horne, chief executive of the National Cyber Security Centre (NCSC).

The NCSC is working with organisations to spot vulnerabilities and close them before somebody exploits them, Horne said. "We're obviously on heightened alert."

The attack on supermarket fridges is just an early sign of what are likely to be increasingly frequent disruptions as old technology fails to keep pace with hackers, Horne said.

(Reporting by Anna Ringstrom in Stockholm, Louise in Copenhagen, Helen Reid, James Davey and Michael Holden in London; Editing by Susan Fenton)