Hackers disrupt refrigeration systems at European supermarkets

What it is

Remote attacks on supermarket refrigeration controllers hit more than 115 stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia. The page does not give a date for the incident. It says the stores were hit overnight and that Coop's affected stores were hit "overnight into Monday". BleepingComputer says it is unclear whether the attack was coordinated or each store was targeted individually.

Store counts per chain, as confirmed by spokespersons:

• Ahold Delhaize (Belgium and Luxembourg): about 40
• Carrefour (Belgium): 15 of 700, in Flanders and Wallonia, no hypermarkets
• Intermarché (Belgium): about 15
• SuperValu (Ireland): 13
• Coop (Sweden): 7 of more than 800
• Spar Colruyt (Belgium): 5
• ICA (Sweden): at least 4
• Selver (Estonia): 1
• Netherlands: at least 17 butcher shops and neighborhood stores
• Belgium, other: an Ikea store in Mons, grocery stores and chocolate shops

How it works

Attackers changed temperature settings remotely, shut units down or triggered defrost. An ICA store manager told TV4 the setpoint was changed overnight to +50°C (122°F) and could not be changed back, so frozen stock was discarded. Coop reported one system that began generating heat.

Sabcobel's director, Stephan Moelans, told RTL the attacker used the same vulnerability as the French attacks the month before. Those hit hundreds of stores using Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB controllers, which were set to defrost mode. The page does not name the vulnerability or give a CVE. It does not confirm which controller models were hit in this wave.

Preconditions / Affected

ICA said the affected stores operate outside its central network. Colruyt said the Spar stores are run by independent entrepreneurs with their own refrigeration systems. Sabcobel was identified as the refrigeration vendor at several of the sites. Exposure therefore seems concentrated in independently managed installations, though the page does not say so directly.

What to do

Moelans said the simplest fix is to manage the refrigeration units over a secure internet connection, which most Sabcobel clients adopted after the French attack. Sabcobel technicians began disconnecting affected installations from 1 a.m. Ahold Delhaize alerted store managers by SMS around 4 a.m. Some stores used refrigerated trucks to protect stock.

Caveats

Moelans said a software update alone is not enough, because the refrigerators also need physical modifications. The page does not say what those changes are. Sabcobel had not answered BleepingComputer's questions when the article was published.