Europe's supermarket fridge attack: does the fix need more than software?
Fridges overheated across Europe seventeen days after French authorities last updated their warning on exposed refrigeration controllers. A contractor managing some affected units says a software update alone would not have been enough.
Fridges and freezers ran hot overnight on 1 to 2 November at dozens of stores in Belgium, Luxembourg, Sweden, Ireland, the Netherlands and Estonia. Carrefour Belgium called it a cyberattack. Delhaize reported an IT incident at about 40 stores.
Reuters reported that at least some units used technology from the Danish firm Danfoss, also targeted in the French attack of 12 October.
Sabcobel, the contractor that manages Delhaize refrigeration, says evaporators were switched remotely into defrost mode, which blows hot air into cabinets. It says this is the same mechanism as in France.
A Proxy Delhaize manager in Overijse described air of about 40 C and discarded all his stock. A Stockholm ICA franchise said its freezers reached 50 C.
Who says what failed
The cause remains unclear. Danfoss told the Flemish broadcaster VTM Nieuws that the vulnerability concerned mainly obsolete software. It added that it had already urged customers to adopt its new version. After the French attack it said affected units were running outdated firmware.
Sabcobel's chief executive, Stephan Moelans, says the repair is more involved. About 20 of the hundreds of units Sabcobel manages were hit. He said a simple software update was not enough to fix the vulnerability and that hardware changes were also needed. He called a secure internet connection the simplest solution, which most clients adopted after the French attack.
France's cyber agency issued a separate warning. Its CERT-FR alert, updated on 16 October, lists Danfoss AK-SM and AK-SC controllers plus Copeland xweb and Dixell xweb units. It calls an internet-facing management interface contrary to good practice. For end of life equipment still exposed, it says a factory reset alone is insufficient. It recommends removing internet exposure and updating firmware.
Why patching and retrofitting cost differently
Patching and retrofitting are different jobs. A firmware update is a software task. Removing internet exposure is network work. Replacing unsupported controllers, where needed, is a hardware purchase.
How big the damage is so far
Coop Sweden counted 7 of its 800 stores, Carrefour Belgium 15 of 700 and Musgrave 13 SuperValu stores. None of those counts measures how many vulnerable controllers remain installed.
The only company loss figure reported is about EUR 15,000 in ruined meat at the Belgian butchery chain De Laet & Van Haver.
Colruyt says its five hit Spar Q8 shops are run by independents with their own refrigeration. In October Intermarche told AFP that insurers do not cover this type of in-store incident.
No investigator has linked 2 November to France, and nobody has been named. Reuters could not establish who was behind the attacks. Belgium's cybersecurity centre said it may never be determined. Belgium's federal prosecutor and Sweden's national cyber security centre are investigating.
CTOL's view
For operators, CTOL sees two commercial questions: what needs to change in affected systems, and who pays. Sabcobel's account adds to the CERT-FR guidance on exposure and end-of-life equipment, though it covers only about 20 units rather than a whole fleet.
Device-level findings from the Belgian inquiry could show whether outdated firmware, exposed management interfaces or both contributed. A CERT-FR update or a Danfoss advisory could clarify what remediation is required.
To distinguish outdated firmware from a hardware gap, investigators would need to identify a unit that had current firmware and restricted management access before the intrusion. Investigators would then need to show how it was compromised. That would challenge the remedy for that configuration. It would not show the fix fails across all units.