Refrigeration systems at more than 115 shops across six European countries were manipulated remotely over a weekend, repeating the method used against French supermarkets in October.
What happened
Store managers arrived to find freezers defrosting, switched off or, in one Swedish case, set to +50 °C with the setting locked. Stock had to be thrown away, and some stores brought in refrigerated trucks to save what they could.
Chains that confirmed problems include Ahold Delhaize (about 40 stores in Belgium and Luxembourg), Carrefour Belgium (15), Intermarché (about 15), SuperValu in Ireland (13), Coop in Sweden (7), ICA (at least 4) and Selver in Estonia (1), along with smaller shops in the Netherlands. ICA noted that its affected stores ran refrigeration connections outside the group’s central network.
How the attackers got in
The director of Sabcobel, a refrigeration contractor serving several affected sites, said the same weakness exploited in France was used again. The French incident involved Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB controllers reachable from the internet. Honeypot operator Lupovis recorded login attempts against Danfoss-style controllers in the ten days before the attack, mostly with factory-default credentials.
Two details matter for defenders. Many of the units are end-of-life and will not receive a patch. And Sabcobel says a software update alone is not enough; the installations also need physical changes.
Who is behind it
No group has been publicly identified for the second wave. It is also unclear whether it was one coordinated action or several.
What to do
- Find every refrigeration, HVAC and building controller with a public IP address and take it off the internet.
- Replace default credentials, including on contractor-installed equipment.
- Put remote maintenance behind a VPN or a managed remote-access service with multi-factor authentication.
- Add independent temperature alarms that do not rely on the controller being honest.