Freezer incident hits ICA and Coop stores across Sweden

Overnight into Monday, fridges and freezers went down at 12 or more ICA and Coop grocery stores across Sweden, with one store claiming they had been hacked and set to 50 degrees Celsius, or 122 Fahrenheit.

ICA said it was an incident that impacted refrigeration and freezer systems at a limited number of stores.

A Sjöbo shop said hackers dialed coolers to 50 degrees

It struck five ICA stores in southern Sweden. They are Ica Kvantum Sjöbo, Ica Kvantum Tomelilla, Ica Nära Böda, Ica Supermarket Brösarp and Ica Nära Sankt Olof.

Ica Baronen in Stockholm was also hit. ICA said the affected stores connect to the internet outside its central network.

Its cooling and freezer systems were hacked and set to 50 degrees, Ica Kvantum Sjöbo wrote on Facebook. Six Coop stores in central Sweden were affected, said Coop press officer Carlos Cancino.

All ice cream freezers and all freezer cabinets were hit at Ica Nära Sankt Olof, said the owner Camilla Nilsson. Chilled goods, if they stay chilled, are sold at half price and everything else is tossed.

Brösarp owner likened the 3 a.m. outage to France’s attack

Mattias Liljegren, who runs Ica Supermarket Brösarp, said the systems were knocked out around 3 a.m. local time and staff detected the problem. He thought it was the same thing that happened in France.

Brösarp has thrown out all of its ice cream and is still sorting through the rest of the stock. Both stores got their systems back and Sankt Olof barred them from the internet.

ICA has sent support to the impacted stores. Cyber security expert Nicklas Keijser has called on stores to disconnect their fridges and freezers from the internet.

Swedish failures came weeks after hackers took control of cooling units at hundreds of French supermarkets in October, French police said. The French attack resulted in loss of food and fires.

French attackers seem to have taken over the defrost function and ran it 24/7 at 50 degrees, Cryptopolitan reported.

Les Mousquetaires, which owns Intermarché, said fridges at about 150 of its stores stayed at 50 degrees for six hours. The group disposed of all the affected food.

Carrefour said 80 of its supermarkets were attacked but most of its 6,000 outlets were untouched. Monoprix said 5% of its ~490 stores in France were affected.

Danish manufacturer Danfoss, which produces the hijacked AK-SM800 and AK-SC355 controllers, said the affected units were running obsolete firmware, much of it, legacy systems that no longer receive security updates. A source close to Prime Minister Sebastien Lecornu said that the French cybersecurity agency ANSSI uncovered a vulnerability in Danfoss software.

Spain, Portugal, Poland, Germany and Belgium were also hit by attacks, said threat analyst Felix Aime. No equipment maker has been identified for the Swedish stores and no link has been made to the French attacks.