The key facts

  • Freezer failures in European retail caused multimillion-euro losses of frozen and chilled goods
  • Professor Kevin Curran: remote access controllers had not been updated for 'about 10 years'; the vulnerabilities have been known for years
  • The number of new exploits in the last month reached 17,060, compared with 30–40 per month ten years ago

Freezer failures linked to outdated remote access controllers

In recent weeks, several European retail chains have experienced freezer equipment failures due to cyberattacks; losses of frozen and chilled goods are estimated in the millions of euros. This is reported in an Euronews article, in which Kevin Curran, professor of cybersecurity at Ulster University, explained the technical side of the incidents in an interview with Stefan Grobe.

What causes the vulnerability

According to Curran, the root of the problem lies in the changes of the COVID era, when technicians needed remote access to refrigeration equipment for servicing without on-site visits. In many cases, the controllers allowing such access had not been updated for 'about 10 years.' The vulnerabilities have 'been known for several years' and allow attackers to get into the system 'even without authentication.' Commenting on companies ignoring these issues, he said that 'the lessons were not learned,' given the age of the vulnerabilities.

Unsophisticated attacks and a rise in exploits

Curran described the attacks as 'unsophisticated': in supermarkets, he said, default passwords were not changed and VPNs were not used, meaning basic cybersecurity practices were not followed. At the same time, he noted an 'unprecedented' and 'dramatic' rise in cyberattacks over the past week: the number of newly discovered exploits in the last month reached 17,060, whereas ten years ago an average of 'about 30–40' appeared per month.

Attack on blood banks in France

According to Euronews, the day before, on November 4, a similar cyberattack affected several blood banks in France, but the problem was detected and fixed before blood products could be spoiled. The article does not say whether the retail and healthcare incidents are linked to the same group or the same vulnerability; it also does not specify which chains were affected.