Mysterious cyberattacks on European supermarket fridges have sent officials around the continent scrambling to figure out the cold, hard facts.
asserted
cyberattacks → send → facts
Supermarkets in a number of European countries reported this week that their fridges and freezers warmed up after they were remotely taken over, resulting in tons of spoiled food at a total cost of millions of dollars (euros).
asserted
they → report → dollars
One Swedish supermarket said its fridges and freezers had been hacked and set to 50 degrees Celsius (122 degrees Fahrenheit).
asserted
fridges → say → degrees
It's a repeat of an earlier incident that struck refrigeration systems in hundreds of supermarkets and independent stores across France, Belgium and the Netherlands.
asserted
that → strike → France
Here's a closer look:
What happened and who was affected
Supermarkets in at least half a dozen European countries, including Sweden, Belgium, Luxembourg, Ireland, Italy and Estonia, reported problems on Monday.
asserted
Supermarkets → happen → Monday
The owner of a butcher shop in Athens told private Greek Skai TV Tuesday that someone hacked into the temperature control of a refrigeration unit, raising the temperature to 150 degrees Celsius (302 Fahrenheit).
asserted
someone → tell → Celsius
George Boubas said his employees who start their shift at 4 a.m. at the shop in the Kifisia suburb first noticed the problem.
asserted
who → say → problem
It took a technician two hours to wrest back control of the unit’s temperature settings, although the meat products weren’t affected, he said.
asserted
he → take → settings
Boubas said the technician told him that an area supermarket and a fast-food restaurant experienced the same issue.
asserted
supermarket → say → issue
He said they resorted to switching off the Wi-Fi connection to the refrigeration units to restrict outside access.
asserted
they → say → access
Experts said the cyberattacks were a reminder of the risks that come as more things get connected to the internet.
“This attack is a wake-up call.
asserted
attack → say → internet
We have filled our homes and shops with devices that are really small computers, yet we still treat them like ordinary appliances," said Katerina Mitrokotsa, a cybersecurity professor at the University of St. Gallen, in Switzerland.
asserted
Mitrokotsa → fill → Switzerland
“A fridge doesn’t look like a security risk, and that’s exactly why attackers like it.”
asserted
attackers → look → it
Fridges are connected to save money and cut waste
The cyberattack mirrors one that happened weeks earlier that affected mainly French and Dutch retailers.
French cybersecurity investigators blamed problems with outdated remote control modules made by Danish company Danfoss as well as U.S.-based Copeland.
asserted
investigators → connect → Danfoss
Danfoss said most affected systems were older products that no longer received software or security updates, while Copeland identified a vulnerability in discontinued controllers.
asserted
Copeland → say → controllers
“Supermarkets connect their fridges so they can monitor temperatures around the clock across hundreds of stores, get alerts before food spoils, cut energy costs and let technicians fix faults remotely," Mitrokotsa said.
asserted
Mitrokotsa → connect → faults
"This saves money and reduces food waste, but every connected fridge is also an entry point that needs to be secured like any other IT system.”
asserted
that → save → system
Experts said many businesses are rushing to embrace trendy new technology while neglecting the vast network of connections that they rely on for their daily operations, from payment and ordering systems to warehouses, refrigeration and other building controls.
asserted
they → say → warehouses
“Organizations are pouring budget into AI and digital transformation while the systems that keep food cold, water clean, and lights on often run on hardware that has not been funded since installation," said Nicole Carignan, senior vice president of security and AI strategy at cybersecurity company Darktrace.
asserted
Carignan → pour → Darktrace
“Nobody broke into these refrigeration systems with a zero-day," she said, using a term for a flaw that has gone undetected by the system’s creators and security reviews.
asserted
that → break → creators
"They got in through internet-facing controllers, end-of-life firmware, and default passwords.
asserted
They → get → life
That is technical debt coming due.”
asserted
That → come → ?
British cybersecurity officials on Tuesday shed little light on the latest attack, while pointing to what they called “legacy technology.”
“The cyberattack on French supermarkets was a result of exploitation of known vulnerabilities,” U.K. cyber minister Liz Lloyd said in a speech.
asserted
Lloyd → shed → speech
“It’s a clear demonstration that poor cyber hygiene, like weak passwords, continues to put organizations at risk.”
asserted
hygiene → ’ → risk
Richard Horne, the head of the U.K.’s National Cyber Security Center, told reporters the French fridges were "connected directly to the internet with default passwords.”
A team from the center issued warnings and worked through Monday night contacting organizations that had “vulnerable technology exposed,” he said.
asserted
he → tell → organizations
No evidence so far that AI was involved
Advanced artificial intelligence systems from companies like Anthropic and OpenAI have come under fire recently after a string of revelations that they hacked into organizations while evading human control.
Experts, however, said Tuesday that they didn't think these attacks were powered by AI.
asserted
attacks → involve → AI
“There is no evidence AI was used, and the techniques did not require it,” said Carignan.
asserted
Carignan → be → it
“I think the key element of that is that this wasn’t an AI attack” said Paul Chichester, director of operations at the U.K. cyber center.
asserted
Chichester → think → center
“This is using vulnerabilities that absolutely have been out there for a long period of time.
asserted
that → use → time
And that’s where we really need to sort of focus on.”
asserted
we → ’ → ?
Who’s behind it and what's the motive
asserted
motive → ’ → it
Investigations have so far failed to discover who might have carried out the cyberattacks and why.
uncertain
who → fail → cyberattacks
France’s national cybersecurity agency, ANSSI, said it has been investigating refrigeration-system breaches since mid-October and coordinating protective measures with “all sectors that could be affected.”
uncertain
that → say → sectors
In a statement to The Associated Press, the agency said it knew of compromised remote refrigeration controllers in Danfoss’s AK-SM and AK-SC ranges, as well as Copeland and Dixell xweb systems.
asserted
it → say → ranges
ANSSI said it was mobilized to assist “potential victims in France” and pointed to a security alert first published Oct. 12, which has been updated regularly.
asserted
which → say → alert
Italian cybersecurity and intelligence officials were scheduled to meet Tuesday morning to discuss the incident, according to Italian news agency ANSA.
uncertain
officials → schedule → ANSA
Officials at the European Union's executive Commission were also holding similar meetings.
asserted
Officials → hold → meetings
European Commission spokesperson Thomas Regnier declined on Tuesday to comment on who might have carried out the hacks, saying that's up to the bloc's 27 national authorities to figure out.
uncertain
that → decline → authorities
Regnier told reporters the incidents “are not isolated” and that Europeans "have to be collectively resilient and prepared for such cyber incidents.”
___
Hadjicostis reported from Nicosia, Cyprus.
asserted
Hadjicostis → tell → Nicosia
AP writers Lorne Cook in Brussels, Lefteris Pitarakis in Athens and Thomas Adamson in Paris contributed to this report.
asserted
Cook → contribute → report
The Aporia
