For the second time in three weeks, hackers have cooked the contents of European supermarket freezers. Overnight into Monday, refrigeration units at Swedish chains ICA and Coop, and at Ahold Delhaize and Colruyt stores in Belgium and Luxembourg, were pushed to as high as 50°C. One ICA store in Sjöbo said its systems were hacked and the stock had to be thrown out. Coop said six or seven of its roughly 800 Swedish stores were hit, and Belgian retailers reported dozens of affected locations. Sweden’s national cybersecurity center said it is working on several incidents. Most of the retailers have not confirmed a cyberattack, but the pattern matches the French case too closely to ignore.

On October 11 and 12, hundreds of French stores, by some counts more than 500, lost fresh and frozen stock after attackers remotely forced defrost cycles on internet-connected controllers, and some stores caught fire. French authorities traced the attack to controllers from Danfoss and at least two other makers. Danfoss said many of the hit units ran outdated software or no longer received security updates, and one researcher said some were still on default passwords. No group has claimed the attack, and no malicious code was reportedly used on the controllers, which makes the hackers hard to identify. The Pentagon is also checking whether hackers caused freezer failures at US military base stores in August. No link between any of the incidents has been established.

Stores connect these controllers to the internet so maintenance contractors can adjust them and get alerts, and many were left unpatched. Reuters found at least 4,500 Danfoss refrigeration interfaces open to the internet, and Sweden’s cybersecurity chief said the country has plenty of exposed devices of this kind. A security firm had published a warning about this exact attack path in August. The cost so far is spoiled food and a few closed stores, but the same access could be used to demand ransom or to hit a food distribution chain harder. Retailers and their refrigeration contractors now face a plain task: find every controller reachable from the internet, patch it or take it offline, and change the passwords.

© Raydn · raydn.us