Supermarket freezers in Belgium and Sweden switched to defrost overnight
Overnight into 2 November, freezers at about 40 Delhaize, 15 Carrefour and about five Spar stores in Belgium were switched to defrost and warmed to around 15°C, per VRT and Colruyt; in Sweden, ICA and Coop reported the same method, with one freezer on Öland reading 55°C, per SVT. It matches the method used on 350+ supermarkets in France in October; nobody has claimed the attacks and no government has named a culprit. The source recommends taking controllers off the open internet, patching firmware and changing passwords.
What happened
Freezers at about 40 Delhaize, 15 Carrefour and about five Spar stores in Belgium were switched to defrost overnight into 2 November and warmed to around 15°C, per VRT and Colruyt. Butcher chain De Laet & Van Haver says its cooling settings were changed from outside. In Sweden, ICA and Coop reported the same method the same night.
Why it matters
Frozen stock can be lost when freezers go into defrost. The same method hit 350+ supermarkets in France in October, and the Pentagon is treating August commissary freezer failures at 6 or more bases as a suspected hack, per 4 officials cited by Reuters. Delhaize calls the case only an "IT incident".
What to do
Take refrigeration controllers off the open internet, patch the firmware and change the passwords. Restrict and audit remote access to these controls. Heed the warning from France's cyber emergency team that a factory reset alone leaves old controllers open to a repeat.
For the technical team
- Affected
- Delhaize, Carrefour e De Laet & Van Haver (Bélgica) Sistemas de refrigeração de cerca de 40 lojas Delhaize, 15 Carrefour e cerca de cinco lojas Spar na Bélgica; cadeia de açougues De Laet & Van Haver · About 40 Delhaize stores, 15 Carrefour branches and about 5 Spar shops in Belgium (VRT, Colruyt Group); ICA stores and 6 Coop stores in Gävleborg, Sweden; 350+ supermarkets in France in October; France's cyber emergency team says old controllers remain open to a repeat after a factory reset.
- Exploitation
- Campaign with no claim of responsibility and no culprit named by any government. France's cyber emergency team warned on 16 October that the campaign was probably still running. The Pentagon is treating August commissary freezer failures at 6 or more bases as a suspected hack, per 4 officials cited by Reuters.
- Fix
- No vendor fix cited in the sources. Mitigation recommended by the source: take controllers off the open internet, patch the firmware and change passwords; the French team warns a factory reset alone is not enough for old controllers.
- Vector
- Refrigeration controllers reachable on the open internet; settings were changed from outside and evaporators switched to defrost, per De Laet & Van Haver and a Belgian refrigeration firm.
- More details
- The wave began around midnight local time (HLN). ICA said all hit stores were connected outside its central network (BBC); one freezer on Öland read 55°C (SVT). At Fort Huachuca, Arizona, every freezer went into defrost overnight, per the commissary. Ahold Delhaize, Delhaize's parent group, only recovered from its own cyber incident last week.
Timeline
The overnight wave into November 2 used the same method as the French attacks; about five Spar shops were also hit, and France's cyber emergency team had warned that a factory reset alone leaves old controllers open to a repeat.
Incident opened.
Sources 2 sources
- @IntCyberDigest @IntCyberDigest
- @shanaka86 @shanaka86
