Hackers Heated Supermarket Freezers to 50 Degrees in Belgium and Sweden Weeks After the Same Attack Hit France

Supermarket staff across northern Europe started Monday by throwing out carts of food. Overnight, attackers remotely switched fridges and freezers into continuous defrost at 50 C, in stores across Belgium, Luxembourg, Sweden and Estonia.

It is the second wave in three weeks. In mid-October, attackers forced the same nonstop defrost on Danfoss controls in hundreds of French supermarkets. The warning was out, and some stores were still exposed.

Dozens of stores in Belgium

The Belgian attack began around midnight on Sunday. Ahold Delhaize and Colruyt said an IT incident had hit fridges and freezers in dozens of stores in Belgium and Luxembourg. About 40 of Delhaize's Belgian stores were reportedly affected, while Le Soir counted dozens of Delhaize and Carrefour locations. Colruyt Group, which runs Spar stores in Belgium under franchise, said five shops had their refrigeration systems attacked.

Delhaize spokesperson Sarah De Meester said the company noticed temperature increases on Monday and is investigating.

Stephan Moelans runs Sabcobel, the refrigeration firm that operates Delhaize's systems. He told the Belga news agency that hackers switched the units' evaporators to defrost mode, and his company estimated at least twenty units were affected. Physical modifications are required, he said, and moving units to a secure internet connection is the simplest interim fix. Most customers had already done that after France.

2 a.m. in Stockholm

In Sweden the targets were ICA and Coop. ICA Kvantum in Sjöbo told customers on Facebook that a cyberattack had pushed temperatures to 50 C. At ICA Baronen in Stockholm, the sales manager said the attack came at 2 a.m. and staff noticed at 5:30 a.m., by which point every freezer was broken.

ICA press officer Gustaf Nilsson said a limited number of stores were affected, without giving a figure. Coop said six stores in central Sweden had similar problems, and press manager Carlos Cancino did not rule out more.

John Billow, who heads Sweden's national cybersecurity centre, said his team was working on several incidents involving grocery store refrigeration. Authorities have also noticed a lot of exposed operational technology devices in the country that must be updated or patched, he said.

In Estonia, refrigeration provider Kitman Coldtech told broadcaster ERR that an unnamed supermarket chain's systems had been set to 50 C. Tom's Hardware also mentions reports from Ireland and the Netherlands.

A simple way in

Refrigeration systems have a forced defrost function. Trigger it remotely and leave it running, and a freezer becomes a heater for hours.

Getting to that switch may not take much. Emil Olofsson, a consultant at Integrity 360, told Swedish news agency TT that the attackers in France got login details for control systems exposed directly to the internet. The hack is not very complicated, he said, and amateurs may have done it. He also said temperatures reached 80 C in some cases and that units caught fire. French police put the temperature at 50 C, while the Paris prosecutor has also said there were fires.

Whether the same route was used this time has not been established. Ahold reported a separate cybersecurity incident to Dutch police last month, but nothing ties it to Monday's attack.

No one has claimed responsibility, and authorities have not named a suspect. The damage has not been totaled either. For now the visible cost is the food on those carts, and the visible weakness is a set of cooling controls that could be reached from the open internet.

Some offers on this page may be paid placements or contain affiliate links.