Supermarket freezers hacked again in Belgium and Sweden, and an installer says patching won't be enough

A software update will not fix this, according to the man whose technicians spent Monday morning unplugging supermarket freezers in Belgium. Stephan Moelans, chief executive of the refrigeration installer Sabcobel, told Belga that the attack uses the same mechanism as the October hit on French stores, and that closing the hole takes physical modifications.

Forty stores, one overnight window

Ahold Delhaize said an "IT incident" hit fridges and freezers in several dozen of its supermarkets in Belgium and Luxembourg. Spokesperson Sarah De Meester said the company had confirmed that cooling temperatures rose, and that it was investigating. In Luxembourg, Delhaize suspended its ordering systems as a precaution, according to Euronews.

The damage ran past the big banner. Le Soir reported that five Spar outlets, several Shop & Go convenience stores attached to Q8 stations, and smaller Proxy Delhaize minimarkets were affected. Carrefour Belgium said 15 of its stores were hit. Spokesman Mich Vergauwen called the effect "very limited," Euronews reported. The Delhaize branch in Hoeilaart told Het Laatste Nieuws it had lost 100,000 euros of produce, a figure the manager said did not count the cost of closing.

In Sweden, ICA said a small number of stores operating outside its central network were affected. A shop in Sjöbo, in the south, posted that its refrigerators and freezers had been hacked and set to 50 degrees, and the BBC reported it later reopened. Coop told Aftonbladet six stores were hit, then told the BBC the count was seven of its 800 and the situation was contained. Euronews reported that Belgian media cited fridges raised to 70 degrees Celsius, against the 50 degrees the Swedish store reported.

Why an installer doubts a patch will do it

Moelans told Le Soir his technicians started mobilizing at 1 a.m. and spent the night and morning disconnecting affected installations from the grid. Euronews reported that about twenty of the hundreds of units Sabcobel manages in Belgium were affected. After the French attack, he said, most of the company's customers moved to managing their fridges over a secure internet connection.

That detail cuts two ways. It suggests the fix for exposed controllers is as much a network change as a firmware one, which fits his claim that an update alone is not enough. It also implies the units that went down had not yet been moved, though the reporting does not say what share that was.

The October record does not make a patch-only story easy to believe either. Danfoss, which supplied most of the controllers hijacked in France according to the Guardian, said it identified the security flaws last year and had long recommended updates. The attackers also disabled alarm systems before changing thermostats or extending defrost cycles. And ANSSI, France's national cybersecurity agency, confirmed that controllers from two other companies were targeted too. No report on Monday's incidents ties them to Danfoss or to any other maker.

Scale, and a loose thread

Monday's count is still small next to France, where police said hackers seized cooling units at up to 700 supermarkets. Some stores there lost more than 130,000 euros, and two in Alsace lost a combined 270,000. The Monday counts are still moving, too: Coop's tally was six stores in one outlet and seven in another.

One loose thread: Ahold Delhaize reported a cybersecurity incident to Dutch police last month, the Guardian and Al Jazeera noted. Neither says it is related to this week's freezers, and the company has not said so.

John Billow, head of Sweden's national cybersecurity centre, told Reuters the centre is responding to multiple incidents involving store cooling systems. Belgium's national cyber agency is also monitoring. No cause had been confirmed in the reports published as of Monday afternoon.