Europe’s Supermarket Freezer Saboteurs Strike Again, 100+ Stores Hit
More than 100 stores in Belgium, Luxembourg, Ireland, the Netherlands, Sweden and Estonia had refrigeration forced into defrost overnight, a month after 700 French supermarkets were hit. Internet-exposed Danfoss and Copeland panels are the common thread.
The people switching off Europe’s supermarket freezers are back. Overnight from Sunday to Monday, refrigeration units in more than 100 stores across Belgium, Luxembourg, Ireland, the Netherlands, Sweden and Estonia were forced to warm up, some to 50°C, SecurityWeek reports. Problems were also reported in Finland, Italy and Portugal. It follows the Oct. 11–12 wave that hit about 700 French supermarkets. No one has claimed either, and investigators haven’t said whether the two are linked.
For defenders
Who was hit: Belgium worst, with Delhaize reporting several dozen stores, Carrefour 15, five franchised Spar shops and an IKEA store in Mons; Belgium’s federal prosecutor is investigating. Also Delhaize in Luxembourg (4), SuperValu in Ireland (13 stores pulled chilled and frozen food), ICA and Coop in Sweden, at least 17 small Dutch businesses per Danfoss, Kesko stores in Finland, Coop-branded shops in Sicily and seven Intermarché stores in Portugal.
The equipment: store refrigeration controllers reportedly made by Danfoss and Copeland, per Dutch broadcaster NOS. In the French wave, CERT-FR first named Danfoss AK-SM and AK-SC controllers, then added Copeland and Dixell XWEB. Attackers pushed evaporators into defrost mode. Researcher Kevin Beaumont says every freezer hit on Monday had a management interface reachable from the internet, and many are end-of-life with no patch coming.
How they got in: officials haven’t said. The signs point to exposed panels and factory passwords: Lupovis says its decoy Danfoss AK-SM sensors saw login attempts from Oct. 20 to 30, mostly with Danfoss’s publicly documented default credentials (T1078.001 (Valid Accounts: Default Accounts)), all rejected. Censys still counts just over 1,000 Danfoss StoreView interfaces online worldwide, though exposed French instances dropped from 1,825 to 220 after October.
What it means for you
For shoppers the risk is spoiled food, and stores have been pulling chilled and frozen stock when units warm up, so check dates and trust your nose if a freezer section looks half empty or recently restocked. For anyone who runs a shop, restaurant, warehouse or building with networked cooling, heating or alarms: if the control panel’s web page can be opened from the open internet, a stranger can probably open it too, often with the password printed in the manual.
Do this now
- Ask your refrigeration or HVAC contractor, today, whether any controller or monitoring panel is reachable from the internet. If it is, disconnect it, as Danfoss told customers to do on Oct. 13.
- Reconnect only through a VPN or the vendor’s secure remote service, and change every default password first.
- Plan to replace end-of-life controllers; per Beaumont many of the units hit can’t be patched, and Sabcobel’s CEO told reporters a software update alone isn’t enough.
- Set temperature alarms that text a person directly, so a warming freezer gets noticed overnight rather than at opening time.