Hackers set ICA store freezers to 50°C weeks after French attacks

Several ICA supermarkets in southern Sweden opened late on Monday and threw out their chilled and frozen food after their fridges and freezers were turned up to 50°C during the night. "What should not have happened has happened. Our fridges and freezers were hacked overnight and they set the temperature to 50 degrees," ICA Kvantum in Sjöbo wrote on Facebook. The store stayed closed until 09:00.

SVT reported affected ICA stores in Sjöbo, Tomelilla, Brösarp, Hammenhög and Sankt Olof in Skåne, and an ICA Nära in Böda on Öland. "Everything is ruined," Dennis Vidal, the store manager in Sankt Olof, told SVT while staff emptied the freezers.

ICA itself has not called it a cyberattack. Press officer Gustaf Nilsson told SVT that "a limited number of stores" were hit overnight by an incident affecting their refrigeration and freezer systems, that the company was investigating, and that it was supporting the stores.

Coop and Delhaize hit the same night

ICA was not the only chain. Coop press chief Carlos Cancino confirmed that six Coop stores in central Sweden were affected, Dagens PS reported, citing Aftonbladet.

In Belgium, Delhaize said an "IT incident" had disrupted the refrigeration systems in about 40 of its supermarkets, in both Flanders and Wallonia. A spokeswoman told VRT it was not a regional problem. Delhaize issued a warning at about 04:00 local time about sudden temperature rises, and temperatures in fridges and freezers reached 15°C, according to VRT, which said it was not yet clear whether this was a cyberattack.

None of the three chains has named the refrigeration system involved or said how anyone got into it. No group has claimed the incidents, and no company or authority has connected them to each other.

What happened in France

Swedish and Belgian reports set Monday's incidents against an attack in France on the night of October 11. Threat actors took remote control of refrigeration controllers at Intermarché, Netto, Coopérative U, E.Leclerc, Carrefour and Monoprix stores, forcing defrost cycles and pushing temperatures up to 50°C. Intermarché and Netto counted at least 300 affected stores and Carrefour 80, franceinfo reported. Some equipment caught fire, and the Paris prosecutor opened an investigation.

The French chains' systems came from Danfoss, through a contractor. Danfoss told franceinfo that most of the affected devices were AK-SM800 and AK-SC355 store controllers that had reached end of life and no longer received firmware or security updates. France's cyber agency, ANSSI, later said Dixell devices had been hit too.

How the French controllers were reached

ANSSI director Vincent Strubel told a Senate committee on October 21 that the attack did not use the vulnerabilities researchers had published in these systems over the previous two years. He blamed "basic security defects": refrigeration equipment exposed directly to the internet, administered without particular protection, and weak passwords. The first of ANSSI's recommendations for industrial systems, published since 2014, is not to expose them to the internet, and "our recommendations are not systematically followed," he said.

Danfoss advised customers to update firmware, strengthen network protection, remove direct internet exposure and replace end-of-life controllers.

ICA, Coop and Delhaize have not said whether their stores use the same equipment. ICA said its investigation was continuing.