5 questions about the cyberattack on European supermarkets

1. What happened?

Attackers remotely took control of refrigeration systems in hundreds of French supermarkets and independent stores in the early hours of Monday, pushing temperatures to 50 degrees Celsius (122 degrees Fahrenheit) for about six hours. Stores had to discard fresh and frozen goods, and Intermarche reported losses of “tens of millions of euros” in a single day. In the Netherlands, Ahold Delhaize shut down systems as a precaution after a “cybersecurity incident” that halted home deliveries and disrupted some store supplies.

2. How did the attackers get in?

France’s cybersecurity agency said it was aware of numerous compromises of remote control modules made by Danish company Danfoss and U.S.-based Copeland. Danfoss said most affected systems were older products that no longer received security updates, and Copeland pointed to a vulnerability in a discontinued, end-of-life generation of controllers. An August report from cybersecurity firm Claroty had identified flaws in both companies’ platforms, which the companies had since fixed.

3. Who is behind it, and are the two incidents connected?

No perpetrators have been publicly identified, and no one has claimed responsibility. Former French cybersecurity agency official François Deruty said the culprit could be anything from a sophisticated state-sponsored group to a disgruntled student. The Dutch National Cybersecurity Center sees no reason to believe the incidents in Europe’s food sector are linked, and Europol is in contact with authorities in the affected countries.

4. Is the food supply at risk?

French Finance Minister Roland Lescure said about 700 of the country’s 10,000 supermarkets were affected, that food supplies were not at risk and that the attack “touches the heart of our food security.” In the Netherlands, Clingendael Institute researcher Pieter Zwaan noted that supermarkets rely on “just in time” deliveries several times a day, and a recent report he co-authored recommends households keep eight days of food, up from the government’s current three-day recommendation.

5. What happens next?

France’s cybersecurity agency warned Tuesday night that the attacks were “likely still underway” and urged stores to reconnect refrigerators only through a secure VPN or protected network, install firmware updates and change passwords. Authorities in both countries are investigating, and Ahold Delhaize was restarting its systems Wednesday. The source material does not say when the investigations are expected to conclude.

For more on this report, read “French cybersecurity authority warns attack may be ongoing as stores scramble to restock” from The Associated Press, published on The Washington Times.