Hackers Crank Supermarket Freezers in Sweden and Belgium Up to 55 Degrees
Set Trending Topics as a preferred source on Google.
Three weeks after France, hackers have taken over the refrigeration systems of supermarkets in Sweden and Belgium.
In the night to Monday, fridges and freezers at dozens of stores belonging to the Swedish chains Ica and Coop and the Belgian chains Delhaize and Carrefour were remotely turned up, to as much as 55°C. “We can’t adjust the temperatures, we can’t change them. Hot air is blowing into the freezers. Everything is ruined,” Rickard Nilsson, head of an Ica store in Sjöbo in southern Sweden, told the newspaper Aftonbladet. Ica spoke of “a limited number of stores” affected by an overnight incident that disrupted refrigeration and freezer systems; affected stores in Sjöbo and Tomelilla stayed closed during the morning. Coop confirmed six affected stores. In Belgium, at least 40 Delhaize stores reported overheated refrigeration, according to NL Times, and Carrefour Belgium named 15 locations. Delhaize’s parent company Ahold Delhaize confirmed “an IT incident affecting the refrigeration systems in a number of Delhaize stores” and said it was assessing the situation. Initial estimates put the damage in the millions of euros.
What Happened in France
The pattern is familiar. In the night to Oct. 12, attackers took control of the refrigeration controllers at up to 700 French supermarkets, including more than 300 Intermarché and Netto stores, 80 each at Carrefour and Coopérative U, and around 30 Monoprix outlets. The units were switched into an unusual defrost cycle with the goods still inside; no alarms went off, and staff were not on site overnight. After six hours, temperatures stood at around 50°C, and at one store in Normandy fridges showed 80°C. Equipment melted or caught fire, sprinkler systems caused water damage, and whole aisles of fresh and frozen food went into the bin. The head of Intermarché parent Les Mousquetaires expects losses in the tens of millions of euros. The Paris prosecutor’s office is investigating, and Prime Minister Sébastien Lecornu instructed the cybersecurity agency ANSSI to coordinate with other European countries. Even then, analysts reported disruptions in Belgium, the Netherlands, Spain, Portugal, Poland and Germany.
The Weak Spot: Refrigeration Controllers Without Updates
At the center are controllers made by the Danish manufacturer Danfoss, specifically the AK-SM 800 and AK-SC 355 models, which run a supermarket’s entire refrigeration plant and are often operated remotely over the internet by maintenance firms. Both reached the end of their life cycle years ago, the AK-SC 355 in 2016 and the AK-SM 800 in 2021, and no longer receive security updates. Security researchers at Claroty had already shown last year that the devices have a publicly reachable login with the username “admin” and a “code of the day” that can be derived from the device’s date. Danfoss released a patch for the current AK-SM 800A series last year; anyone who did not update remained vulnerable. According to The Hacker News, current devices running outdated firmware were also affected, as were controllers from Copeland and Dixell. After the attack in France, an estimated 4,500 Danfoss controllers were still openly reachable on the internet, in supermarkets across Europe. Danfoss said most of the affected units were older products and that it was working with customers on firmware updates and on ending direct exposure to the internet. The French agency CERT-FR advised disconnecting the controllers or strictly filtering access to them.
That it worked again three weeks later shows how slowly that advice is being implemented. Supermarkets typically outsource their refrigeration to service providers and often have no control over the security of the devices themselves. Who is behind the attacks remains unknown; neither the French authorities nor Danfoss have named any perpetrators. Ahold Delhaize was hit by a separate cyberattack only in October, which forced the group to shut down IT systems across several brands, with normal operations resuming only last week. Whether the incidents are connected is an open question.
Sabotage or “Kids Messing Around”?
There are two ways to read this. After the attack in France, E.U. Agriculture Commissioner Christophe Hansen said food security “requires more attention at all levels,” and Coopérative U chief Dominique Schelcher called the attack “unprecedented” and “extremely serious.” Security experts have warned for years that critical infrastructure, from power plants to food stores, is vulnerable because of poor IT security and outdated software, and state actors such as Russia or Iran are considered both capable and willing to sow unease with sabotage of this kind. That Scandinavian and Belgian chains have now been hit fits the picture of a coordinated campaign.
The counterargument comes from the security industry itself. Three cyber experts told Reuters that the attack appeared easy to carry out. Ken Munro of Pen Test Partners thinks it possible that “kids messing around” are behind it, because the flaw is so simple to exploit: Anyone who finds the openly reachable controllers needs no state budget to turn them up. For retailers, it makes no difference; the goods are spoiled either way. For Europe, it does: In one case the answer would be deterrence, in the other simply a firmware update that has been available for more than a year.
