Hackers breached old refrigeration systems belonging to the Danish company Danfoss in Estonia, raising the temperatures of refrigerators and freezers in dozens of European stores to 50 degrees Celsius. Danish authorities are warning of a possible recurrence in Denmark.

Refrigerators and freezers in several food stores in Sweden, Estonia, Belgium, Luxembourg and Ireland were hit by cyberattacks on Monday, after hackers breached refrigeration and temperature control systems, raising temperatures to levels as high as 50 degrees Celsius and damaging large quantities of food.

The Danish Community Safety Authority (Styrelsen for Samfundssikkerhed) warned of the possibility of similar attacks on Danish shops, and called on shop owners and businesses to review their refrigeration and freezing systems and ensure they are protected.

Widespread attacks target stores in several countries

European media also reported that stores belonging to the ICA and Coop chains in Sweden were subjected to cyberattacks, including 6 Coop stores in the center of the country and a number of ICA stores.

The Swedish newspaper Aftonbladet reported that the attacks damaged food products in at least five stores, while other reports indicated that the number of affected stores was greater.

At the ICA store in the Swedish city of Sjöbo, management announced via Facebook that the cooling systems had been hacked, after the temperatures in the refrigerators and freezers were set at 50 degrees Celsius.

Swedish television SVT quoted Mats Olsson, manager of the ICA Böda store, as saying that he was surprised to find a puddle of water on the store floor when he arrived in the morning, after the temperature of one of the freezers had risen to 55 degrees Celsius, confirming that all the refrigerators and freezers had broken down and that the goods had been damaged.

Swedish company Axfood was also subjected to a cyberattack, according to Swedish websites quoting Reuters. Axfood is one of the largest grocery groups in Sweden, with customers in the retail sector with supermarkets and wholesale to restaurants and businesses.

The breaches affect Belgium, Luxembourg, and Estonia.

In Belgium, the refrigeration and freezing systems of Ahold Delhaize stores suffered an electronic incident, according to a company spokesperson quoted by the NL Times, who explained that the extent of the Dutch stores being affected was not yet known.

The newspaper reported that at least 40 stores in Belgium were affected by the incident, including stores belonging to the Carrefour chain.

The attacks also extended to Estonia, where the Estonian public broadcaster ERR reported that Lidl, Coop and Rimi stores were hacked, and that temperatures in freezers rose to 50 degrees Celsius.

Hackers breach old cooling systems manufactured by the Danish company Danfoss in Estonia

The CEO of Kitman Coldtech, the manufacturer of the affected cooling technologies in Estonia, explained that the hackers gained access to an old control system belonging to the Danish company Danfoss, which allowed them to raise the temperatures in refrigerators and freezers to 50 degrees Celsius.

Ireland also announces a breach of cooling systems

The incidents were not limited to the four countries, as the Irish supermarket chain SuperValu announced that the cooling systems in 13 of its stores had been affected by an electronic incident.

Reuters quoted the company confirming the incident, noting that refrigeration and freezing products had been removed from the affected stores.

SuperValu is the third largest food retail chain in Ireland, operating 223 stores.

Danish company Danfoss appears in hacking investigations

The current attack brought to the forefront a similar incident that occurred in France in October, when hundreds of supermarkets were hit by cyberattacks targeting refrigeration systems, causing temperatures in refrigerators and freezers to rise.

The thermal control regulators used in those systems were manufactured by the Danish company Danfoss, which explained in a previous statement to the Ritzau news agency that the incident affected a limited number of systems.

Danish authorities warn of the possibility of similar attacks.

In Denmark, the Community Safety Authority (Styrelsen for Samfundssikkerhed) announced that it is monitoring developments in European countries and is in contact with government agencies and relevant companies to verify whether Danish companies have been affected by the attacks.

According to TV2, the agency said in a written response to the website that similar attacks in Denmark are possible, and therefore called on authorities, companies and institutions to review the protection procedures for refrigeration and freezing systems.

The authority requested that shop owners take the following measures:

• Check if refrigerators, freezers and their associated control systems are directly accessible via the internet.
• Make sure that the necessary security updates are installed on devices and systems.
• Studying the possibility of cutting off or restricting direct internet access, when possible without affecting the basic functions of the systems.
• Contact the hardware suppliers or the companies that installed it to get help when needed.
• Report any suspected system breaches to the police via the number 114 or the official website politi.dk.
• Report incidents via the website virk.dk if the organization is subject to the requirements of the European Cybersecurity Directive NIS2.

Danish stores confirm no problems have been detected so far

Regarding the extent to which Danish stores were affected, the Salling Group, which operates the Netto, Bilka and Føtex chains, announced that it had not detected any irregularities or disruptions in its store systems.