1. A second night, seven more countries
What looked like a French incident is now a European pattern. On the night of Sunday 1 to Monday 2 November, refrigeration systems in shops in seven more countries went haywire, three weeks after attackers heated the fridges and freezers of about 700 French supermarkets. Belgium was hit hardest: Ahold Delhaize confirmed an "IT incident" in "several dozen stores" in Belgium and Luxembourg, about 40 by press counts; Carrefour Belgium counted 15 outlets, and Spar about five. In Ireland, Musgrave pulled chilled and frozen food from sale in 13 SuperValu stores.
The rest of the map is patchier but points the same way. Sweden's Coop confirmed a hack at seven stores; an ICA store in Sjöbo found its freezer set to 50°C. At least 17 Dutch businesses, from butchers to a frozen-food storage facility, were affected, and so were one store of Estonia's Selver and a couple of small Finnish K-food shops. BleepingComputer counts more than 115 sites. The real spread may be wider: in October, Félix Aimé of the security firm Sekoia told Reuters that Spain, Portugal, Poland, Germany and Belgium had also been affected, without giving details. No group has claimed responsibility.
2. The same door, left open
The attackers did not break the machines; they used them as designed. In France, they reportedly switched refrigeration controllers to a forced, continuous defrost with a setpoint of 50°C, at night, when shops were closed. France's cybersecurity agency named Danfoss's AK-SM and AK-SC controller series, and said systems from Copeland and its subsidiary Dixell were also hacked. Danfoss said most affected units were older products that no longer received software or security updates.
The second wave went through the same gap. Danfoss said the new incidents involved its products, and in the Netherlands, it said, the affected systems were not on a secure network and still used a default password. Stephan Moelans, head of the Belgian refrigeration fitter Sabcobel, said the attacker exploited the same vulnerability as in last month's French attacks, and that a software update is not enough: the units also need physical modifications. The security researcher Kevin Beaumont said many of the exposed controllers are end-of-life, with no patch available. Even inside big chains, the weak spots sat at the edge: at ICA, the affected stores had their connection outside the group's central network, a spokesperson told Dagens Nyheter.
3. The bill lands on the shop floor
The damage is counted in spoiled food, and it adds up fast. In France, two stores in Alsace lost about 270,000 euros of goods between them, including about 220,000 euros at one E.Leclerc, and the national toll runs to millions of euros, by French press estimates. In Belgium, about 100,000 euros of food was thrown away overnight, Euronews reported. France's finance minister, Roland Lescure, said in October that the attack "touches the heart of our food security", while insisting supplies were not at risk.
The response is still manual. Technicians in Belgium worked "all night and morning to disconnect the affected units from the network", Moelans said, and some shops kept goods in refrigerated lorries. Musgrave said its incident was "limited to a specific model of refrigeration". Danfoss had warned customers on 13 October to disconnect these systems from the internet or allow only secure connections, three weeks before the second wave.
4. Le Détroit's reading
Who is behind it, and why, remains unknown, and the two waves may not be the work of the same people. The Paris prosecutor's cybercrime unit is investigating the French attack. Three signals will tell more: a claim or a ransom demand; whether the attacks reach countries that use the same controllers but have not yet reported damage; and the US military's investigation into freezer failures at at least six base commissaries in late August, reported by Reuters on 29 October: the Army's criminal investigators say they are working with French law enforcement on "the refrigeration outages in Europe".
