Supermarket Freezer Hack Spreads to Six Countries: The Key Numbers

A suspected cyberattack overnight into Monday pushed up the temperatures of refrigerators and freezers at dozens of supermarkets and smaller shops in six European countries, the BBC reported. The affected stores are in Belgium, Luxembourg, Sweden, Ireland, the Netherlands and Estonia. Local media reports cited by the BBC say food worth millions of euros had to be thrown away.

It is the second such incident in about three weeks. In the night to Oct. 12, attackers took control of refrigeration systems at up to 700 supermarkets in France, according to French police as cited by The Guardian. Nobody has been named as responsible for either wave.

The numbers behind the second wave

• About 40 Delhaize stores: The BBC reported that roughly this many Delhaize supermarkets in Belgium and Luxembourg were hit. NL Times, cited by Trending Topics, said at least 40 Belgian Delhaize stores reported overheated refrigeration.
• 15 Carrefour stores in Belgium: Carrefour said only this many of its Belgian locations were affected and that all of its shops stayed open.
• Six or seven Coop stores in Sweden: Coop told Aftonbladet that six stores were affected. It told the BBC that seven of its 800 Swedish stores were hit and that the situation was contained. Reports differ on the exact count.
• 13 SuperValu stores in Ireland: The BBC reported that Musgrave Group, the chain's owner, told The Irish Times the impact was limited to a specific model of refrigerator.
• At least 17 Dutch companies: A Danfoss spokesperson told Dutch public radio NOS that cooling systems at this many companies were attacked, mostly butcher shops and small neighborhood stores.
• €100,000 in lost produce at one store: A Delhaize branch in Hoeilaart, Belgium, told Het Laatste Nieuws it lost this much, and the manager said the figure did not include losses from closing the shop.

How the attack worked

Stephan Moelans, chief executive of the Belgian refrigeration company Sabcobel, told the Belga news agency that the units' evaporators were switched into defrost mode, which makes them warm up. The BBC said this is believed to be the same method used in France. Reports on the peak temperature differ slightly. Trending Topics said some units were turned up to as much as 55°C, while the BBC reported readings as high as 50C (122F).

In Sweden, Rickard Nilsson, who runs an Ica store in Sjöbo, told Aftonbladet that staff could not change the settings and that hot air was blowing into the freezers. “Everything is ruined,” he said. Trending Topics reported that stores in Sjöbo and Tomelilla stayed closed during the morning. The BBC said the Sjöbo store has since reopened. Ica said the affected stores operated outside its central network.

Why it matters: spoiled food, closed shops and an unpatched weak spot

For shoppers, the most visible effects are closed stores and discarded fresh and frozen goods. For store owners, the losses can be large, and some do not include the cost of lost trading days. In France, The Guardian reported, individual stores lost anywhere from tens of thousands of euros to more than €130,000, and two stores in Alsace reported a combined €270,000.

Both The Guardian and Trending Topics point to controllers made by the Danish company Danfoss, which are often connected to the internet so maintenance firms can monitor them remotely. According to Trending Topics, two of the models involved no longer receive security updates, and security researchers at Claroty had shown last year that they had a weak login. Danfoss told The Guardian it identified security flaws last year and had long recommended that customers install updates.

Fixing the problem is not always a software matter. Moelans told the BBC that Sabcobel's units needed physical modifications, not only updates, and that the simplest remedy is to manage fridges over a secure internet connection. He said most customers switched to that after the French attack.

Who is behind it, and what officials are doing

The perpetrators are unknown. Trending Topics said two readings are circulating. Some security experts have long warned that state actors could carry out sabotage of this kind. Three cyber experts told Reuters, however, that the attack appeared easy to carry out, and Ken Munro of Pen Test Partners said it was possible “kids messing around” were responsible.

Trending Topics noted that Ahold Delhaize, the parent of Delhaize, was hit by a separate cyberattack in October that disrupted IT systems across several brands. Whether the incidents are connected is an open question. The Guardian reported that the company said it had established that cooling temperatures rose and that the incident was being investigated.

Belgium's and Sweden's national cybersecurity agencies said they were monitoring the situation, the BBC reported. The UK's National Cyber Security Centre said it was working with international partners and industry to understand the incident. No incidents have been reported in the UK.

Around Prague, based on reporting by www.trendingtopics.eu, The Guardian, BBC News