On Sunday night, someone turned up the temperature inside supermarket fridges and freezers in seven European countries. By Monday morning, tonnes of food were in the bin. Nobody forced a door. They did it over the internet.
What actually happened
The attacks started overnight and were spotted in the early hours of Monday. Around 40 Delhaize shops in Belgium and Luxembourg were hit, along with 15 Belgian branches of Carrefour, five Spar stores and an IKEA store in Mons. Shops in Sweden, Ireland, the Netherlands, Estonia and Finland reported the same thing.
In some stores the temperature in the chilled cabinets reached 50°C. A manager at an ICA shop in Stockholm told Reuters that the freezers had hit 50 degrees and that “everything is destroyed”. One Delhaize branch in Hoeilaart, near Brussels, put its loss at €100,000 of produce in a single night. A Belgian butcher found his fridges at 18°C and threw away about €15,000 of meat.
The method was the same one used in France last month, when hundreds of supermarkets were hit and a few cabinets caught fire. Every commercial fridge has a defrost cycle — a normal setting that briefly warms the unit so ice melts away. Someone switched it on and removed the limits that normally stop the temperature climbing.
Why a shop fridge is on the internet at all
A commercial fridge is not a metal box with a motor. It is a small computer with a network connection, and the maintenance company uses that connection to read temperatures and fix faults without sending someone out at night. That part is genuinely useful.
The trouble is where those controllers sit. Researchers found many were reachable from the open internet, behind built-in service logins with passwords that were easy to obtain. The manufacturer shipped a fix in August. Thousands of units never received it, and the oldest models cannot be updated at all.
Why this matters to you
You probably noticed nothing, and that is part of the story. The bill lands on the shop, not on your bank account. But three things reach you.
The food, first. Everything in those cabinets had to be thrown away, which is why some chilled shelves sat empty this week. The cost, second: losses like this end up in prices. And third, the uncomfortable one: this is a rehearsal. The same weak setup exists in heating systems, door entry, security cameras and the building controls of offices, schools and hospitals.
What you can do
You cannot patch a supermarket’s fridge. You can do five things that are actually yours to control.
- Buy chilled and frozen food from the back of the shelf, and feel the pack. A soft, warm or damp pack has been through a temperature rise. Put it back and tell a member of staff.
- If a chilled shelf is empty this week, pick something else. That is stock being thrown out, not a shortage, and there is no reason to stockpile.
- Be suspicious of messages about refunds, recalls or “your order” from a supermarket. Scammers follow a story like this within hours, and the news gives them a reason to ask for your card details.
- Change the password on anything in your home that connects to the internet: the smart plug, the camera, the heating controller, the baby monitor. The password printed on the box is often the same on thousands of others.
- Keep those devices inside the maker’s own app instead of opening them up to the whole internet. A camera you can watch from anywhere is a camera anyone can reach.
Common misunderstandings
Myth: this was a break-in to steal data
Nothing so far suggests customer details were taken, and no group has asked for money. Security researchers looking at the pattern say the absence of a ransom demand points to sabotage — damage for its own sake, or to show how exposed these systems are.
Myth: the food on the shelves is unsafe
The affected stock was removed and binned, which is the whole point of the attack: waste, not poison. Your shop is not selling warmed-up chicken. If a pack feels wrong when you get it home, take it back — that is your right as a customer.
Myth: my fridge at home is next
The fridge in your kitchen does not work this way. What it shares with those supermarket units is the habit behind the attack: a device with a factory password, connected to the internet, that nobody ever updated. That habit is worth fixing at home.
What to watch for next
The European Commission called an emergency meeting with its cyber security agency ENISA and with Europol on Monday, and both Belgian and Swedish authorities are investigating. No arrests and no claim of responsibility have been reported.
Expect repeats. Last month’s French attack cost retailers millions of euros and nobody was caught, which is an invitation to try again. Watch for two things: chilled and frozen ranges that stay thin in some shops for a few days, and a wave of fake messages that use the story. Your supermarket will not ask for card details by email or text because of a fridge.
The one thing to remember
The most ordinary object in the shop — the freezer — is a computer on the internet, and nobody updated it. The same is true of the small connected things in your home. A factory password changed today is the cheapest security you will ever buy.
Image: a supermarket freezer aisle. Photo by Phillip Pessar, CC BY 2.0, via Wikimedia Commons.