Temperatures spike in several countries
Refrigerators in dozens of supermarkets across Belgium, Sweden, and Luxembourg failed on Monday after temperatures spiked to 50 degrees Celsius. This incident mimics the mid-October cyberattacks in France where hackers manipulated defrosting mechanisms to overheat store fridges. Belgian broadcaster RTBF cited a store manager who said the problems resulted from a cyberattack like the one in France. The supermarket chain Delhaize alerted managers early Monday to an "IT incident affecting the refrigeration systems in a number of Delhaize stores." Dutch media reported that Delhaize stores in Luxembourg also faced these refrigeration issues. Belgian retailer Colruyt said five Spar stores in Belgium faced problems, though no Colruyt stores were affected. Fifteen Belgian Carrefour stores also suffered from the malfunctions. In Sweden, the supermarket chain ICA confirmed that the incident overnight affected a small number of ICA stores operating outside the ICA central network. Swedish media also reported that Coop stores were hit.
Swedish retailer Coop told the daily Aftonbladet on Monday that six of its stores suffered from the overnight incident, while ICA confirmed a limited number of stores were affected by an incident which impacted their refrigeration and freezer systems. This pattern of overheating mirrors the massive French attack in October where hackers seized control of cooling units at up to 700 supermarkets. These attackers pushed temperatures from as low as -27C to well over 50C and caused massive food loss of fresh meat, dairy, and frozen products. The French attack was a total failure of digital security for the retail sector. The hackers hit chains including Intermarche, Cooperative U, Carrefour, Leclerc and Monoprix. Many French stores lost between tens of thousands and 130,000 euros, while two stores in Alsace reported a combined loss of 270,000 euros.
Vulnerabilities in cooling controllers
| Incident Detail | Specifics |
|---|---|
| Temperature Spike | Up to 50 degrees Celsius |
| French Attack Scale | 700 supermarkets |
| French Loss (Alsace) | €270,000 |
| Swedish Coop Impact | 6 stores |
In France, hackers hijacked controllers from Danish manufacturer Danfoss to disable alarm systems and extend defrost programs. Danfoss stated it identified security flaws last year and long recommended that customers install updates. ICA reported its affected stores operated outside the ICA central network. Stephan Moelans, the chief executive of Sabcobel, told Le Soir that his technicians started mobilizing at 1am to disconnect affected installations from the grid. Belgian reporter Le Soir noted that the issues hit multiple Shop & Go convenience stores and Proxy Delhaize minimarkets. The Centre for Cybersecurity Belgium is following the incident closely.
The Paris prosecutor’s office opened a formal investigation into the French attack, which caused food losses and fires. After the report of widespread food spoilage, French Prime Minister Sebastien Lecornu instructed the national cybersecurity agency, ANSSI, to investigate the matter. ANSSI confirmed that supermarkets using controllers from two other companies also faced the October attack. These attackers in France bypassed alarms before they adjusted thermostats or extended defrost programs for hours to cause maximum spoilage.
