Swedish Grocery Freezers Knocked Out Overnight as Stores Point to Hack

Fridges and freezers died at 12 or more ICA and Coop grocery stores across Sweden overnight into Monday. One of them, Ica Kvantum Sjöbo, told Facebook followers its cooling and freezer systems had been hacked and dialed up to 50 degrees Celsius — 122 Fahrenheit. ICA called it an incident that hit refrigeration and freezer systems at a limited number of stores.

Five ICA stores in southern Sweden took the hit: Ica Kvantum Sjöbo, Ica Kvantum Tomelilla, Ica Nära Böda, Ica Supermarket Brösarp and Ica Nära Sankt Olof. Ica Baronen in Stockholm was also affected. ICA said the stores connect to the internet outside its central network. Six Coop stores in central Sweden were hit too, according to Coop press officer Carlos Cancino.

At Ica Nära Sankt Olof, owner Camilla Nilsson said every ice cream freezer and freezer cabinet went down. Chilled goods that stayed cold are being sold at half price; the rest is going in the bin. Over at Ica Supermarket Brösarp, Mattias Liljegren said the systems dropped out around 3 a.m. local time and staff spotted the problem. He suspects it echoes what happened in France. Brösarp has dumped all its ice cream and is still picking through what's left.

Both stores got their systems back, and Sankt Olof barred them from the internet. ICA has sent support to the affected locations. Cyber security expert Nicklas Keijser urged stores to disconnect their fridges and freezers from the internet.

The Swedish outages land weeks after hackers seized control of cooling units at hundreds of French supermarkets in October, according to French police. Food was lost and fires broke out. Attackers appeared to hijack the defrost function and run it 24/7 at 50 degrees, Cryptopolitan reported. Les Mousquetaires, which owns Intermarché, said fridges at about 150 stores held 50 degrees for six hours, and the group threw out all the affected food. Carrefour said 80 of its supermarkets were attacked, though most of its 6,000 outlets escaped. Monoprix said 5% of its roughly 490 French stores were affected.

Danish manufacturer Danfoss, which makes the hijacked AK-SM800 and AK-SC355 controllers, said the affected units ran obsolete firmware — much of it legacy systems that no longer get security updates. A source close to Prime Minister Sebastien Lecornu said French cybersecurity agency ANSSI found a vulnerability in Danfoss software. Threat analyst Felix Aime said Spain, Portugal, Poland, Germany and Belgium were also hit. No equipment maker has been identified for the Swedish stores, and no link has been made to the French attacks.