Hackers Turn Off Supermarket Freezers Across Europe

I woke up to a strange one today. Supermarket freezers in Belgium and Sweden got switched to defrost overnight, and it looks like someone did it on purpose, over the internet. Staff spent Monday morning throwing out melted food.

What happened

Delhaize says about 40 of its stores in Belgium and Luxembourg were hit. Carrefour says 15 of its Belgian shops were too, and five Spar stores got caught up as well, per VRT and the BBC. Over in Sweden, a few ICA and Coop stores had the same problem. One ICA shop found its freezers set to 50°C. The BBC also lists 13 SuperValu shops in Ireland.

Sabcobel installs and looks after refrigeration for a lot of these shops. Its boss, Stephan Moelans, told Belga it kicked off around midnight. Somebody flipped the evaporators into defrost mode remotely. That's the exact same method used on hundreds of French supermarkets back in October. Delhaize is calling it an "IT incident." No one has owned up to it yet, and cyber agencies in Belgium and Sweden say they're keeping an eye on things.

Why it matters

Belgian media report that one Delhaize store, in Hoeilaart, lost about €100,000 (roughly $115,000) of food, and that's just one shop. Multiply that across dozens of stores in a handful of countries and it gets expensive very quickly.

What bothers me more is how simple this seems. Nobody needed to steal data or encrypt servers. They just had to reach the controller of a fridge that someone had connected to the internet for remote monitoring. Moelans says a software update on its own won't close the hole and some units need physical changes, but the quickest win is putting them on a secure connection.

What to do

• If you run a shop, restaurant or warehouse with remotely managed refrigeration, call your installer today. Ask whether the controllers are reachable from the open internet and get them behind a VPN or a private connection.
• Change default passwords on any building systems you can log in to, and switch on temperature alarms that ping a phone, not just a screen in the back office.
• At home, the same idea applies to smart plugs, cameras and thermostats: update them and don't expose their admin pages to the internet.

Attacks on everyday services are clearly ramping up. Cloudflare's latest DDoS report, which I covered last week, shows the same rise in attacks from the network side.