Polish police confirm several cyberattacks on store fridges and cold stores

Police confirm several attacks

Poland's Central Bureau for Combating Cybercrime (CBZC) has confirmed it holds information about several cyberattacks on refrigeration systems at companies operating in Poland. Its spokeswoman, Monika Przestrzelska, told TVP Info that the bureau is verifying the cases, because not every affected business has reported its attack. Radio RMF FM reported, based on its own inquiries, that police have recorded at least 10 attacks on shop fridges and cold stores in Poland. Police have not disclosed which facilities were hit or whether the attacks caused damage. The bureau said on 6 November that the number of reports had grown in the days before.

What investigators are doing

The CBZC has set up a dedicated team to collect signals and evidence from every local police unit that holds information about incidents involving refrigeration equipment. Complaints can be filed with any police unit, not only the CBZC, and according to the bureau each unit has its own specialists in this area. The bureau supports local officers who lack specialist equipment or need help with their inquiries. The spokeswoman described the work at this stage as follows:

“We are at the stage of collecting information, accepting notifications of crimes and analysing the security of IT infrastructure.”

The bureau says the Polish cases may be linked to similar incidents in other European countries, and it remains in contact with services in those countries.

Wave of attacks across Europe

The Polish incidents follow a pattern seen elsewhere in Europe since October. In France, hackers took control of fridges and freezers at about 700 supermarkets and changed the temperature settings, which spoiled food and produced combined financial losses in the millions of euros.

Ireland, Sweden, Belgium, Portugal and Luxembourg were among the countries that confirmed cyberattacks on refrigeration systems in early November. A Danish agency said two pro-Russian hacker groups claimed responsibility for at least part of the attacks.

Blood storage at risk

In France, attackers also targeted fridges at the French blood establishment that store blood, and tried to raise their temperature. The CSIRT at the Centre for e-Health (CSIRT Centrum e-Zdrowia) issued recommendations for the health sector and warned in a statement:

“Attacks on systems responsible for storing blood, plasma, medicines and other biological materials may lead to disruptions of operations, material losses and a threat to the continuity of medical services.”

The health-sector guidance also calls for closer monitoring of configuration changes on critical devices, testing of incident response and continuity plans, and removal of default access in favour of new credentials under a strong-password policy.

Recommended protection

Police advise companies that use refrigeration systems to verify their networks, controllers and control panels, and to check whether these can be reached directly from a public IP address. They also recommend changing infrastructure passwords, updating software, and installing security patches and the latest firmware released by equipment makers. The same guidance applies to shop owners and food wholesalers, according to RMF FM's report on the police advice. The CBZC adds that careful use of IT infrastructure and following manufacturers' instructions can help prevent an attack.