Hackers flip supermarket freezers into defrost mode in second European wave

Three weeks after hundreds of French stores were hit, attackers reached refrigeration controls in Belgium, Luxembourg, Sweden, the Netherlands, Ireland and Estonia overnight. The installer that runs Delhaize's fridges says the method was identical and that a software patch alone will not close the hole.

Overnight from Sunday to Monday, someone reached into the refrigeration controls of supermarkets in at least six European countries and told them to stop cooling. By morning, freezers in Belgium, Luxembourg and Sweden were blowing warm air and managers were hauling out spoiled stock.

It is the second such wave in three weeks. On the night of Oct. 11-12, about 700 supermarkets in France were hit, according to the French government, including more than 300 Intermarché and Netto stores. No alarms went off, temperatures climbed to roughly 50°C over about six hours, and some stores reported fires.

Staff clear out refrigerators at an ICA store in Stockholm on Monday morning

Same trick, old software

Stephan Moelans, chief executive of Sabcobel, the installer that manages Delhaize's refrigeration in Belgium, said the attack followed "exactly the same mechanism" as in France: the evaporators were switched into defrost mode, the cycle normally used to melt ice off the coils, and left running. About 20 of the several hundred units his company looks after were affected. A software update alone will not fix it, he said; physical changes are needed, and the simplest safeguard is a secured internet connection.

Danish manufacturer Danfoss said the vulnerability sits mainly in outdated software and that it had already advised customers to move to newer versions. The controllers hijacked in France were Danfoss AK-SM 800 and AK-SC 355 units, which reached end of life in 2021 and 2016 and no longer receive security fixes; researchers at Claroty showed last year that their login pages could be reached from the open internet. Whether the Belgian and Swedish stores used the same models has not been officially confirmed.

In the Netherlands, a Danfoss spokesperson said freezer or cooling systems at no fewer than 17 companies were tampered with overnight. According to the Dutch broadcaster NOS, the company said those systems were not behind a secured network and still used a default password.

Six countries, no claim of responsibility

In Belgium, Delhaize confirmed about 40 affected stores, Carrefour 15 of its 700 and Colruyt five independently run Spar shops, and the federal prosecutor has opened an investigation. Euronews reported 13 SuperValu stores hit in Ireland, citing owner Musgrave, and one Selver supermarket in Estonia. In Sweden, ICA spoke of a "limited number" of stores without calling it a cyberattack, while Coop reported trouble at six stores.

Emptied freezer aisle at a French supermarket after the October refrigeration attack

No group has claimed either wave. After the French attack, Ken Munro of Pen Test Partners told Reuters the flaw was simple enough that bored teenagers could be behind it, and Swedish security expert Emil Olofsson said amateurs could be behind Monday's intrusions. John Billow, head of Sweden's national cybersecurity centre, told Reuters the country has "quite a lot of exposed operational technology devices" that still need updating or patching. Ahold Delhaize, parent of Delhaize and Albert Heijn, was hit by a separate cyberattack in October, and Delhaize says it is still examining whether the two are connected.

Photos: TT News Agency; VRT NWS; Reuters

Hackers flip supermarket freezers into defrost mode in second European wave