The Fridge Is Still OT: Three Weeks of Warnings, Then Seven Countries

Mira, amigos. Three weeks ago I wrote that the fridge is OT. I was hoping that post would turn into a “remember when” story. Nope. It got a sequel.

Overnight from Sunday, November 1 to Monday, November 2, refrigeration controllers at supermarkets, butchers and small food businesses in Belgium, Luxembourg, the Netherlands, Sweden, Ireland and Estonia were manipulated so the cases warmed up. Finland’s NCSC also reported “a few hits,” though Kesko, the retailer there, says the cause is still under investigation. The play looks familiar. According to Belgian refrigeration installer Sabcobel, evaporators were remotely switched into defrost mode, “the same scenario” as France in October.

Some stores reported freezers set to 50 C. In Belgium, freezers reached around 15 to 17 C before people caught it. Either way, that’s product in the dumpster.

What we actually know

Belgium got hit hardest by the numbers. HLN tallied at least 76 Belgian sites as of Monday afternoon by adding up chain statements: about 40 Delhaize stores, 15 Carrefour stores out of more than 700, around 15 Intermarché, 5 independently run Spar stores and the Ikea in Mons. Other outlets put it lower, and The Record said more than 50. Belgium’s federal prosecutor has opened a criminal investigation.

Elsewhere, attributed and as of Monday:

Luxembourg: 4 Delhaize stores, per Delhaize Belgium to L’essentiel.
Netherlands: at least 17 businesses, mostly butchers, small neighborhood shops and one frozen storage site, per a Danfoss spokesperson to NOS. The big Dutch chains told reporters they weren’t affected.
Sweden: 7 of more than 800 Coop stores (Coop to the BBC), a “limited number” of ICA stores, and freezers at one Axfood home delivery distribution center (Reuters).
Ireland: 13 of 223 SuperValu stores, per owner Musgrave to RTE, all resolved by Monday afternoon.
Estonia: one Selver store, contained in about 10 minutes by its contractor, per ERR.

BleepingComputer counted more than 115 stores across six countries from chain statements, and AFP said more than 100. These numbers were still moving when I wrote this, so treat every one as a November 2 snapshot, not a final count.

For scale, the Paris prosecutor now tells The Record there were “around 700 victims” in the French wave, which lines up with what France’s finance minister said in October.

What we don’t know

No one has claimed either wave. No government has attributed either one. Belgium’s CCB told The Record it’s not known who is behind this, “and it may never be possible to identify them.” The Record also says it isn’t known whether the same actor is behind both waves.

You’ll see hacktivist names and theories floating around. Forescout has tracked more than 20 claimed hacktivist attacks on refrigeration systems this year, but a Telegram claim is not evidence for this case, and Forescout itself says the initial access and actors behind the French incidents remain unconfirmed.

The equipment picture isn’t clean either. Danfoss’s communications chief told DR that incidents in several countries involve its products. But a Belgian butcher told NOS that Copeland equipment was attacked too, and Musgrave only says the Irish cases involved one unnamed “specific model.” So no, this isn’t automatically a Danfoss story. And no authority has published a root cause.

The part that stings: the warnings were out

This wave wasn’t a surprise. It was a test of how we responded to the first one.

After France, CERT-FR published and updated its guidance, CCB Belgium put out a “patch immediately” warning on October 13, and Danfoss told Dutch customers that same day to disconnect units from the internet and reconnect only through a secure network. Now Danfoss’s Dutch spokesperson tells NOS the systems that got hit “were not on a secure network and had a default password.” Then came the line that stuck with me: “The majority of stores took measures then, but a small number did not. They are now paying the price.”

Ouch. But honest.

Look at who got hit. Butchers. Neighborhood shops. Franchise and independent stores. ICA said its affected stores were “operating outside ICA’s central network.” Kesko described its affected stores as not under its central protection. Those are the sites where nobody from central IT owns the refrigeration box in the back room, and the contractor relationship is a phone number on a sticker.

It’s like head office changed the locks on every door, but the side door at the franchise store still has the key under the mat.

And for some of this gear, there’s no quick patch. Sabcobel says some units need “physical modifications,” not just a software update. Forescout found that 80 percent of the exposed Danfoss StoreView services it observed were running AK-SM 800A firmware older than 4.3.1. Old gear doesn’t fix itself over a weekend, claro.

The good news: alarms worked

Where somebody was watching the process, the damage stayed small. A Belgian butcher got alarms around 3:00 AM and caught it early. A Proxy Delhaize owner got an alarm at 3:00 and had cooling back within 15 minutes, per HLN. Selver’s contractor in Estonia contained it in about 10 minutes, with a rise of only 2 to 3 degrees. Musgrave’s monitoring flagged the SuperValu stores.

Compare that with store-level loss estimates of at least 60,000 euros at one Belgian Proxy Delhaize and 100,000 euros at a Delhaize in Hoeilaart. An alarm that wakes a human at 3:00 AM is about the cheapest OT security control you will ever buy.

Meanwhile, in the US (separate story)

Quick note so nobody connects dots that aren’t there. A Pentagon official confirmed a DCIS-led investigation into refrigeration failures at US military commissaries in late August, and Reuters reported officials are treating it as a suspected hack. Army CID says it’s working with French law enforcement to understand “the refrigeration outages in Europe.” That’s cooperation, not a confirmed link. No source has established what caused the commissary failures, what equipment was involved, or any connection to Europe. This is press reporting only, and I’ll leave it there.

Bottom line

Get a yes or no in writing from your refrigeration contractor for every site, franchises included: is anything reachable from a public IP?
Kill default passwords and direct exposure. Bring remote access back only through a VPN or gateway with named accounts and MFA.
Make sure alarms wake a person at night. That’s what saved the stores that caught it fast.

Wave 1 was the warning. Wave 2 was the exam. Stay sharp out there, familia.

Javier