Supermarket freezer hacks spread to Belgium, Sweden and beyond

Between Sunday night and early Monday, November 1 to 2, cooling systems in several European countries started to warm up when they should have stayed cold.

The reports come from several outlets and agencies. Reuters, Bloomberg, the Belgian news agency Belga and the Swedish paper Aftonbladet all carried pieces, and Tom's Hardware pulled them together.

• Belgium: Delhaize says about 40 of its stores were hit, in both Flanders and Wallonia. Carrefour Belgium counted 15 stores, and the Colruyt Group said five independent Spar shops were affected.
• Luxembourg: Reuters reports that Delhaize and Colruyt stores there were also hit.
• Sweden: ICA says a "limited number" of stores had trouble with their refrigeration and freezer systems. Coop told Aftonbladet that six of its stores were affected.
• Estonia: a technology supplier, Kitman Coldtech, told the public broadcaster ERR that a large chain was hit too, with a freezer set to 50 degrees Celsius.

Nobody has claimed responsibility, and the companies have been careful about the word "attack." Delhaize calls it an "IT incident." ICA did not confirm a cyberattack in its statement to Bloomberg.

First, a quick explainer. A supermarket freezer has an evaporator, the part that chills the air inside. Every so often it heats up on purpose to melt the frost that builds up. That is called a defrost cycle.

Stephan Moelans, the head of the Belgian refrigeration company Sabcobel, which looks after Delhaize's systems, told Belga the incident was a cyberattack. He said the units' evaporators were switched to defrost mode. Sabcobel puts the start at around midnight.

The result is simple. A freezer that should sit at about minus 18 degrees Celsius starts to warm like a car parked in the sun.

In real life Imagine someone pressing the "defrost" button on every freezer in a shop at midnight, from the other side of the internet, while the staff are asleep. By morning, the ice cream is soup.

The numbers differ, and that is worth saying plainly.

• Belgium: RTL Info cites about 15 degrees Celsius, mostly in freezers. The daily HLN wrote of 70 degrees, a figure a Delhaize spokesperson could not confirm.
• Sweden: one ICA store in Sjöbo said on Facebook that its freezers were set to 50 degrees Celsius and that it suspected a hack.

Why it matters: even 15 degrees is far too warm for frozen food. Stores have to throw the stock away rather than guess.

At the butcher chain De Laet & Van Haver, alarms on the chiller units began to sound around 3 a.m., according to operations manager Werner Muylle. Staff paused the system before the fridges got too hot, the Brussels Times reports.

Delhaize texted its store managers around 4 a.m. Some managers called in refrigerated trucks to save their stock. Delhaize says it disconnected the cooling systems from the internet, and that its shops can keep trading.

In Stockholm, a notice at an ICA Baronen store said all its freezers were broken because of a cyberattack. The sales manager told Reuters the attack happened at 2 a.m. and was noticed at 5:30 a.m.

The French attack hit the night of October 11 to 12. Hackers gained access to internet-linked refrigeration controllers and raised temperatures to as high as 50 degrees Celsius while shops were closed.

AP reports that French Finance Minister Roland Lescure told parliament about 700 of the country's 10,000 supermarkets were affected. He said there was no risk to food supplies, but that the attack "touches the heart of our food security."

• Intermarché and Netto: about 300 stores, according to their owner Groupement Mousquetaires.
• Coopérative U: 80 of its 2,000 stores, according to its CEO Dominique Schelcher.
• Also hit: Carrefour, Monoprix and E.Leclerc.

The Paris prosecutor's office opened an investigation, and the retailers reported fires in some stores and large food losses.

France's cybersecurity agency said the systems were remote control modules made by the Danish company Danfoss and by Copeland, a US-based company. Al Jazeera reports the Danfoss models included the AK-SM800 and the AK-SC355.

These are small computers that sit inside a store and manage all of its fridges and freezers. They are connected to the internet so that maintenance companies can adjust them from anywhere. That is handy, and it is also the problem.

Danfoss said most of the affected systems were older products that no longer receive software updates. Software updates, often called firmware updates when they go inside a device like this, are how makers patch security holes. Copeland said the weakness was in a discontinued, end-of-life generation of controllers.

Partly. In August, the US security firm Claroty reported flaws in the Danfoss AK-SM 800A and the Copeland XWeb Pro. It said "numerous controllers" could be reached directly from the public internet. Danfoss and Copeland have since released fixes.

Help Net Security notes that it is unknown whether those exact flaws were used in the French attacks. Nobody has said yet what was used in Belgium or Sweden.

Christopher Whyte, a homeland security professor at Virginia Commonwealth University, told AP such an attack is "not too difficult," because the controls were likely left open to the wider network a supermarket uses.

Sweden's national cybersecurity centre said something similar. Its head, John Billow, told Reuters the centre has "identified that we have quite a lot of exposed operational technology devices in Sweden." Operational technology means the machines that run physical things, like freezers, pumps and doors. He said they need to be updated or patched.

No source reviewed says so. The method sounds the same, which is why the story spread fast. But a similar trick can be copied by anyone once it is known.

Reuters adds that Ahold Delhaize, Delhaize's parent company, reported a separate cybersecurity incident to Dutch police last month. Help Net Security wrote in October that there was no sign the two cases were linked.

There are also other reports that Irish stores were hit. Clash Report, citing The Irish Times, says Musgrave pulled chilled and frozen food from 13 SuperValu stores after a "cyber incident" limited to a specific model of equipment.

• Your groceries are not in danger today. Stores are throwing away suspect stock, and the French minister said supplies were safe.
• Expect some bare freezer shelves in the stores that were hit, for a short while.
• Your own fridge is a different story. These attacks hit shop controllers, not home appliances. Still, any device you connect to the internet needs updates and a strong password.
• For store owners: French authorities advise taking the controllers off the open internet, updating firmware, changing default passwords and allowing access only through a protected network.

If you have ever wondered what happens when a fridge gets too smart, we wrote about one that stopped working after an update.