Supermarket fridges hacked across Europe as temperatures hit 50C
Key takeaways
- Hackers pushed supermarket fridges and freezers to 50C in seven European countries on Monday, forcing stores to throw out spoiled food.
- The attackers targeted older cooling controllers made by Danish firm Danfoss. The company calls them legacy products with no security updates.
- No group has claimed responsibility. A SentinelOne researcher says the lack of ransom demands points to sabotage, not theft.
Hackers turned supermarket fridges into heaters across Europe on Monday. They pushed temperatures inside fridges and freezers to 50 degrees Celsius. Stores in seven countries had to dump food.
No one has claimed responsibility yet.
What happened
Stores in Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands and Sweden reported the same problem early on Monday, November 2. Fridges and freezers stopped cooling overnight. Some units reached 50C. Staff found ruined stock in the morning.
In Belgium, Delhaize said dozens of stores were hit. The company called it an IT incident at first. Le Soir, a Belgian newspaper, reported about 40 Delhaize stores affected.
Colruyt Group said five of its Spar stores had fridge systems attacked. Carrefour Belgium said hackers hit 15 of its 700 stores. A company spokesman left no room for doubt.
"It is a cyberattack, there is no other reason," said Mich Vergauwen, according to NovaNews.
In Sweden, Coop said hackers hit six of its roughly 800 stores. The stores used 4G mobile networks instead of newer 5G. Coop spokesman Carlos Cancino said that made them more exposed to hackers.
ICA is one of Sweden's biggest chains. It said a limited number of its stores had refrigeration problems. One ICA store in Sjobo posted on Facebook about the attack.
It said hackers had set its fridges and freezers to 50C. "There has been a cyberattack and all our freezers reached 50 degrees," said Engla Ingwall. She is a sales manager at an ICA store in Stockholm.
She told Reuters the attack came at 2 am. Staff noticed it hours later.
Ireland's Musgrave group, which owns Supervalu, reported 13 affected stores. In the Netherlands, a small number of corner shops had problems. In Finland, the Kesko group found odd temperature readings at a few smaller grocery stores.
In Estonia, at least one supermarket was attacked. The hackers raised its refrigeration temperatures to 50C, according to public broadcaster ERR.
Why it matters
The attackers did not break into the stores. They went after the control systems that run the fridges. Many European stores use older refrigeration controllers made by Danfoss, a Danish company.
The attackers used these systems' own features against them.
Every freezer has a built-in defrost function. It clears ice buildup on the cooling coils. The hackers triggered this function remotely and left it running.
Instead of cooling, the equipment heated for hours. Staff who opened the fridges in the morning felt a wave of heat. A sector source told BFM, as reported by SecurityAffairs.
Danfoss told AFP that most affected equipment were legacy products. That was after the earlier French attack. That means older models that no longer receive software or security updates.
Danfoss has not responded to requests for comment on the latest attacks.
This is the second wave in less than a month. On October 12, hackers seized control of cooling units at hundreds of French supermarkets. French police said the attack caused fires and food losses.
France's cyber agency published an alert about the Danfoss systems within a day. Researchers at Predicta Lab counted 2,752 Danfoss systems still reachable from the internet. That was after the French attack.
About 1,590 of them were in France. That number explains why the attacks keep spreading.
The attacks look like sabotage, not theft. The hackers asked for no money. They stole no data.
They simply used the equipment's own functions to destroy food. Tom Hegel works as a researcher at cybersecurity firm SentinelOne. He said the lack of financial demands points to sabotage.
Christophe Hansen is the EU's food and agriculture commissioner. He said food security needs more attention at all levels. He added that the exploitation of food is now a reality.
Stores are learning this the hard way. In Sweden, John Billow heads the national cybersecurity centre. He told Reuters his team was working on several incidents across the country.
Sabcobel is the Belgian refrigeration firm that runs Delhaize's systems. It said it had started securing its installations after the French attack. But around 10 percent were still not fixed.
Some of those were in the shops hit on Monday. Belgian federal prosecutors have opened an investigation.
What happens next
Nobody knows who is behind the attacks. Authorities have not named the method used to break in. Emil Olofsson is a cybersecurity consultant at Integrity 360. He said the attackers got login details for control systems exposed to the internet.
He told Swedish news agency TT the hack was not very complex. Amateurs could have done it, he said. In Portugal, the Mosqueteiros group said seven Intermarche stores were hit.
The attack came through an external service provider that manages the cooling systems.
Retailers now face two jobs at once. They must check every store for spoiled food. They must also take old cooling controllers off the open internet or replace them.
That is expensive and slow. The affected units are older models scattered across thousands of shops.
For shoppers, the key question is food safety. Stores threw out products that had warmed up. Meat and dairy that spent hours at high temperatures are unsafe to eat.
If a store sold you food on Monday from a warm case, return it. Check for official notices from the store.
The attacks also raise a bigger question about everyday equipment. Fridges, heating systems, security cameras and alarm networks were once purely mechanical. Now they can be monitored and controlled over the internet.
That gives cybercriminals new openings. As John Billow of Sweden's cybersecurity centre said, exposed devices must be updated or patched. Until they are, the freezers remain targets.
For more background, read about the earlier attack on a Ukraine emergency app. In other tech news this week: Apple's November 6 product launches and the PS5 firmware war over GTA VI.
Related stories
Apple plans two October launches: smart home hub, OLED MacBook Pro
Apple set October 13 for a smart home launch with a new hub, Apple TV 4K and HomePod mini, then October 27 for OLED MacBook Pro models
How to Check If Your Phone Supports eSIM in 30 Seconds
Dial *#06# and look for an EID number to confirm eSIM support in under 30 seconds. This guide also walks through the iPhone and Android
eSIM vs iSIM: what is the difference?
An eSIM is a dedicated chip on the phone's board, while an iSIM lives inside the processor itself. Qualcomm's Snapdragon 8 Gen