This is the follow-up to the French attack we covered on Oct 12 and when it grew to about 700 stores. The new wave hit between Sunday night and Monday morning, Nov 1 to 2.
Who's hit. Chains that confirmed problems to BleepingComputer: Ahold Delhaize in Belgium and Luxembourg (around 40 stores), Carrefour Belgium (15), Intermarché Belgium (around 15), Spar Colruyt (5), Coop Sweden (7), ICA Sweden (at least 4), SuperValu in Ireland (13) and Selver in Estonia (1). In the Netherlands, Danfoss told broadcaster NOS that at least 17 butcher shops and neighborhood stores were attacked. IKEA says its store in Mons, Belgium was affected, which Euronews says brings Belgium to 75 stores. Finnish media report several K Group supermarkets too. Delhaize also paused its ordering systems in Luxembourg as a precaution.
Same method as France. Stephan Moelans, CEO of Sabcobel, the installer that runs Delhaize's refrigeration, told Belga it was a cyberattack using "exactly the same mechanism" as France: the units' evaporators (the cooling coils) were switched into defrost mode so the cases warmed up. In Estonia a contractor said attackers got into an older Danfoss system, and NOS reported Copeland equipment was targeted in Belgium (per The Record). After France, both vendors said the hit devices were mostly discontinued products that no longer get security updates.
Why a patch won't cut it. Moelans said a software update alone doesn't fix this and that physical changes to the units are needed, which costs money. His fastest fix is managing the fridges only over a secure connection, which he says most of his customers did after France. Musgrave, which owns SuperValu, said the damage was limited to one specific fridge model.
What we'd do today if we ran security for a grocer, cold-chain warehouse or food distributor anywhere in Europe. Get your refrigeration contractor to list every Danfoss, Copeland and Dixell controller you own and how it's reached from outside. Pull anything that's directly on the internet and put contractor access behind a VPN. Check that defrost schedules and temperature setpoints match what they should be, and send temperature alarms to someone awake at 2 a.m. Belgium's national cyber center (CCB) says it's aware of the incident but has no more details, and no agency has named who did it.