Spain is exposed to the fridge hackers, with around 300 systems visible online

A cybersecurity analyst has found around 300 commercial fridge and freezer systems in Spain that can be seen from the internet, while hackers keep spoiling food in supermarkets across Europe. Although visible doesn’t mean they’re directly vulnerable, and no attack has been reported in Spain so far, nothing should be ruled out just yet. 

An analyst went looking within hours of the latest attacks 

Marcelino Madrigal, a network and security analyst, searched for refrigeration and climate-control equipment that can be reached from the internet in Spain as news broke on Monday November 2 of a fresh wave of supermarket hacks across Europe. He found around 300 units. 

They’re the kind of commercial and industrial systems that let technicians check temperatures, receive fault alerts and change settings without visiting the shop or warehouse. The reports didn’t say where the Spanish units are or who owns them, though. 

“Exposed means they can be seen and reached from the internet,” Madrigal said. “Exposed is not the same as vulnerable. To find that out I’d have to try to get in, and I don’t want to be arrested.”

So he didn’t try, which means nobody yet knows how many of the units, if any, could actually be taken over. 

Spain appears to have been spared so far

No attack has been reported in Spain up to now, and food distribution sources told the EFE news agency that it’s unusual for firms here to outsource the remote control of their refrigeration. Madrigal still isn’t ruling it out. “Of course it can happen here too,” he said.

Spain’s national cybersecurity institute, INCIBE, said it’s too soon to tell how the attackers got in, with the attacks so recent and so little to trace. It also doesn’t know yet whether any Spanish equipment shares the same weaknesses.

Old equipment is the weak spot

The Danish manufacturer Danfoss said many of the systems hit in other countries had reached the end of their life and no longer received security updates. France’s cyber emergency team CERT-FR has also named kit from Copeland and Dixell among the systems broken into there. 

Madrigal said a unit only becomes vulnerable if it shares those conditions, meaning out-of-date software, insecure settings or poorly protected access. Security researchers had already flagged weaknesses in Danfoss controllers back in August.

What owners are being told to do

CERT-FR’s advice is that the systems controlling temperature shouldn’t be reachable directly from the internet at all, with technicians connecting through protected links instead. Owners should also check their updates, passwords and defrost settings, since the French attackers reportedly stretched defrost cycles to heat the units. Danfoss says to keep supported systems updated and replace models that no longer get security patches.

So anyone running a bar, restaurant or shop in Spain with a remotely monitored fridge, freezer or cold room should ask their installer whether it can be reached from the internet, and whether the software is up to date.