Hackers took over supermarket fridges across Europe

Overnight into Monday, October 12, someone broke into the refrigeration controls of French supermarkets and set the fridges to heat. The attackers took the automatic defrost, which normally runs about two hours a day, and switched it to a forced, continuous cycle at 50 degrees Celsius (La Dépêche). That’s 122 degrees Fahrenheit, inside the cases meant to keep your milk cold.

Stores found it on Monday morning, when a source says “a wave of heat” came out of the fridges and freezers as they were opened (La Dépêche). Coopérative U’s president, Dominique Schelcher, confirmed the attack on his stores’ refrigeration and called it “extremely serious and unprecedented. It is unacceptable” (CNBC).

The chains hit included Carrefour, Monoprix, Intermarché and Coopérative U, by Reuters’ count (CNBC). Les Mousquetaires, which owns Intermarché, says about 180 of its stores were affected and expects “several million euros in losses” (CNBC). La Dépêche reports the hacked controls were made by Danfoss, and that two stores in Alsace alone lost 270,000 euros.

Some headlines said fires, and Intermarché’s owner says otherwise so far: in some of its stores the overheating “resulted in smoke, but no fires have been reported” (Les Mousquetaires, to CNBC). A Sekoia threat analyst says the attack also reached Spain, Portugal, Poland, Germany and Belgium (CNBC, citing Reuters). Albert Heijn’s Dutch owner, Ahold Delhaize, reported its own “security issue” and took systems offline (CNBC). Tom’s Hardware says it’s unclear whether the two attacks are related.

If you run anything with a remote-controlled thermostat, from a restaurant walk-in to a garage freezer, find out who can log in to it from the internet, change the default password and turn on the temperature alerts it offers. An alarm on your phone at 2 AM costs a lot less than a case of spoiled food at 8.

Les Mousquetaires says the attack hit one of its service providers that manages refrigeration inside some stores. And the setting the attackers reportedly turned on the fridges was the defrost, a function built to protect them (La Dépêche).