Some freezers at over 100 European stores were pushed as high as 50°C on Monday, Nov 2, according to SecurityWeek, three weeks after a first wave hit about 700 supermarkets in France. If you run a shop, or you own anything with a remote management page, the part to read is how the attackers got in because the answer looks boring and fixable.
I use the word hack because the EU agriculture commissioner and several retailers do. ICA and Kesko have not confirmed a cyberattack as the cause, and nobody has been named.
The supermarket freezer cyberattack in Europe on Nov 2
Whether you call it supermarket fridges hacked or an IT incident, the Delhaize and Carrefour cyber incident in Belgium is the biggest clusterfuck. Delhaize told Belgian media a “computer incident” hit 40 shops overnight, and Carrefour said it was “currently analysing” the incident at 15 of its Belgian stores, the BBC reports.
Colruyt said five franchised Spar shops were attacked, and the Belgian federal prosecutor’s office has opened an investigation, per SecurityWeek.
In Ireland, wholesaler Musgrave said 13 of its SuperValu stores were affected, and some chilled and frozen products came off sale, Reuters reports. In Sweden, ICA and Coop freezers at 50 degrees made the pictures. A store in Sjöbo wrote on social media that its fridges and freezers “have been hacked overnight, and they have set the temperature to 50 degrees,” and Coop told the BBC that 7 of its 800 Swedish stores were affected. Engla Ingwall, sales manager at an ICA franchise store in Stockholm, told Reuters the attack happened at 2 a.m. and was only noticed hours later. “Everything is destroyed,” she said.
Counts differ by outlet. SecurityWeek says over 100 stores across Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden, with problems also reported in Finland, Italy and Portugal. The BBC’s own tally is about 40 Delhaize, 15 Carrefour and 13 SuperValu stores, plus ICA and Coop. Coop said that unauthorised tampering hit its systems, while ICA told AFP it could not confirm that a cyberattack was the cause. That is confirmed in one place and open in another, which is why I keep the word reported close.
How a freezer controller ends up reachable from the internet
SecurityWeek quotes the security researcher Kevin Beaumont saying that people he spoke with confirmed that every freezer hit on Monday had a management interface reachable from the internet, and that many of the devices are end of life with no patches available. That is his account, not an official finding, and officials have not publicly explained how the attackers got in.
The supplier details point the same way. Dutch broadcaster NOS reported that the targeted devices were made by Danfoss and Copeland, and ICA told AFP its affected stores used a refrigeration control system from Danfoss, the supplier also involved in the French attack. Danfoss said it told customers on Oct 13 to cut their systems’ internet connections and reconnect only through a secure network.
“Most stores took action, but a small number did not,” a Danfoss spokesperson told NOS, as quoted by SecurityWeek.
France’s CERT-FR first linked the October compromises to Danfoss AK-SM and AK-SC controllers, then widened its alert to Copeland and Dixell XWEB systems, and Danfoss said most of the hacked units were legacy products it no longer updated.
The exposure counts show the scale. Censys found just over 1,000 Danfoss StoreView interfaces reachable online worldwide. In France, the count fell from 1,825 before the October attacks to 220. Censys also counted 138 in Belgium, 51 in the Netherlands and 50 in Sweden, with an estimated 68%, 37% and 58% of them running a patched version. Censys did not say whether any patched device was among those compromised on Monday. Sabcobel chief executive Stephan Moelans told Belga that a software update is not enough, and the equipment also needs a physical modification.
On passwords, the only hard data point is a honeypot. The security firm Lupovis told SecurityWeek that its Danfoss AK-SM sensors saw login attempts between Oct 20 and 30, peaking on Oct 26, and most used factory-default credentials that Danfoss documents publicly. All were rejected, and that tells us what attackers tried, not what victims left in place.
Why the second wave followed the first
The first wave hit France overnight from Oct 11 to 12, when around 700 supermarkets had refrigeration forced into defrost mode, SecurityWeek reports. Help Net Security, citing BFMTV, put the damage at tens or hundreds of thousands of euros for affected shops. In Belgium, Moelans said the attackers forced evaporators into defrost mode again, so the technique appears to be the same. Investigators have not said whether the two waves are connected, and AFP reports no one has claimed responsibility for either.
My opinion is a guess, and I label it as one. Censys counted far fewer exposed units in France after the first wave, and the second wave landed in countries where its counts are still 138, 51 and 50. That does not prove causation. It is the pattern I would check first.
The EU agriculture commissioner, Christophe Hansen, did not hedge on intent.
“… a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it.”
That is how he described the attacks to Reuters, and SecurityWeek adds that Hansen said the bloc’s food security is not under threat for now. I will not guess at a motive.
Boring cause, unknown culprit, spoiled food.
What a shop or a smart-home owner can check this week
Start with the advice Danfoss gave on Oct 13: take the controller off the open internet, and reconnect only through a secure network. Then ask your installer two blunt questions. Is the model still getting updates and is the default login changed? A patch alone may not close it, per Sabcobel, so ask what else the supplier requires.
Add an alert that does not depend on the same controller. Ingwall’s store noticed hours after 2 a.m., while Musgrave said that its monitoring systems alerted it to the issue. That gap is where a cheap independent temperature sensor earns its price. And the logic holds at home: if a fridge, camera or router has a management page reachable from the internet, treat it the way these stores should have.
I am watching three things: whether the Belgian federal prosecutor names a suspect, whether any group claims either wave, and whether investigators link the two. None had happened in the reports I read on Nov 3.
Do you think there’s something greater behind this? Let’s talk in the comments.