Swedish Supermarkets Hit by Cyberattack, Freezers Ruined
Hackers targeted refrigeration systems at multiple Swedish supermarkets, raising freezer temperatures to 55°C and spoiling vast amounts of food.
Multiple Swedish supermarkets, including several ICA locations and six Coop stores, have fallen victim to a cyberattack that compromised their refrigeration systems, leading to significant food spoilage. The attackers manipulated the systems to raise freezer temperatures to as high as 55°C, rendering perishable goods unsalvageable and forcing store closures and extensive clean-up operations.
Incidents were reported across various regions in Sweden, with affected ICA stores located in Sjöbo, Tomelilla, Brösarp, Sankt Olof, and on Öland, Värmland, and in Stockholm. Coop stores in Gästrikland and Hälsingland also reported similar issues. For instance, one ICA store manager discovered a freezer at 55°C upon arrival, with all cooling systems disabled and the contents ruined. Another store temporarily closed its doors after its freezers reached approximately 50°C.
While the exact entry point, exploited vulnerabilities, and the identity of the attackers remain unconfirmed in Sweden, the incidents bear a striking resemblance to similar attacks that occurred in French supermarkets during October. In those French cases, threat actors reportedly compromised Danfoss AK-SM and AK-SC controllers, as well as Copeland xweb and Dixell xweb devices. These attacks highlight a critical vulnerability in industrial control systems when their management interfaces are exposed to the internet.
Cybersecurity experts have noted that the affected Swedish supermarkets had internet connections outside of their central corporate networks. This detail suggests a potential vector for the attack, though it does not confirm the specific method used. The lack of confirmed evidence linking the Swedish and French incidents means any claims about specific vulnerabilities being exploited in Sweden would be premature.
However, the pattern of attacks serves as a stark warning about the security of connected refrigeration and industrial control systems. The French national cyber response team, CERT-FR, previously issued an alert advising operators to secure remote access to these systems, preferably through a VPN, and to ensure firmware is up-to-date. They also recommended disabling direct internet exposure of management interfaces.
CERT-FR's advice for French supermarkets included checking controller settings, particularly defrost schedules, as prolonged defrost cycles can inadvertently raise internal temperatures. They also stressed the importance of changing default passwords and coordinating any system changes with refrigeration service providers. Resetting unsupported controllers alone is insufficient if the underlying exposure remains, as re-compromise is likely.
The attacks underscore a growing trend of threat actors targeting operational technology (OT) and industrial control systems (ICS) that manage physical processes. Unlike traditional IT breaches that affect data, these attacks can have immediate and tangible consequences, such as spoiled inventory, operational downtime, and significant financial losses, as demonstrated by the widespread food spoilage in Sweden.
As investigations continue, the incidents in Sweden and France emphasize the urgent need for robust cybersecurity measures for all connected industrial equipment. Retailers and facility managers must prioritize securing these systems against remote access and ensuring regular maintenance, updates, and vigilant monitoring to prevent similar disruptions.