50°C in the freezers, ten countries, and a patch from August

On Monday, supermarkets in at least ten European countries found their freezers warming up. Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Germany and Sweden all reported problems, temperatures reportedly reached 50°C, and stock had to be thrown away¹. This came three weeks after an attack hit as many as 700 French grocery stores¹. Nobody has claimed responsibility¹.

The numbers are concrete. Delhaize had dozens of stores affected in Belgium and Luxembourg, Carrefour 15 Belgian stores, and Intermarché 15 of its 153 in Belgium. Thirteen SuperValu stores were hit in Ireland and seven Intermarché stores in Portugal^1,2. Belgium’s federal prosecutors have opened an investigation, and the European Commission convened its interinstitutional task force with ENISA and Europol on Tuesday morning^1,2.

This is not a story about sophisticated attackers. Italy’s government said the affected businesses mostly had “obsolete” systems with interfaces exposed to the internet and weak authentication¹. The Swedish adviser Fredrik Blix said the control units “sit directly on the public internet”. In his account, the vendor patched the flaw in August, but thousands of units never got the update and the oldest cannot be updated at all². Some retailers traced the problem to outside companies that manage their refrigeration. In western Germany, a Rewe store’s outage was linked to an attack on the system provider Danfoss¹.

Who is behind it remains unknown, and the Commission’s spokesman declined to attribute blame¹. Guessing does not protect a single freezer. What does is an inventory of which devices are online, who holds the passwords and when the last update was installed. Britain’s NCSC has already told retailers to update their fridge temperature controls¹.

If you run a shop, a kitchen or a care home with remotely monitored equipment, ask your service company one question this week: is our controller reachable from the internet, and is it patched?