I'm extrapolating a bit here based on Reddit hearsay, but I think this may have to do with rural stores having essentially consumer-grade internet routers connected to the mobile broadband network.<p>Much of the coverage in Swedish media drives the point that only 4G-uplinked stores have been hit so far. I think that's unfortunate, because really it wouldn't have differed if these stores were connected by 5G.<p>I'm guessing here, but my money would be on freezer ICS systems being made available to the world by accident by way of NAT-PMP on a consumer router. In Scandinavia you can bypass CG-NAT on mobile connections by setting a particular APN, so my guess is that these control systems were simply findable on Shodan.<p>This also explains why this wasn't discovered after the recent French breach. Supposedly all the stores with "proper" uplinks were in compliance, and no one had thought of a way in for those non-compliant stores, because they "weren't even connected, so how would an attacker get in?"
> I'm guessing here, but my money would be on freezer ICS systems being made available to the world by accident by way of NAT-PMP on a consumer router.<p>Why would there be accidental port mappings on their router though? I could maybe see owners setting it up so they could monitor from home, but even that is a bit of a stretch for rural supermarket owners
Considering how Europe has embraced huawei and I saw a lot of their gear in consumer use when I was there, I’d be interested in seeing the Ben diagram of huawei gear and impacted stores
How did every supermarket chain around the world not jump at this and investigate?
have you seen how big enterprises operate? It would generally take much longer from a decision to do something to any action happening, budget approvals etc.<p>And for anything infosec, unfortunately people who know a lot about infosec have a habit of 'crying wolf' and talking about infosec as some kind of absolute rule that everything has to bow down to with no willingness to balance against other business risks, so probably leadership is used to ignoring the people who knew that this was a big deal and were calling for action.
Probably most of them had exactly zero inhouse expertise in cybersec and just pretended there’s nothing to worry about because having to worry would be inconvenient. <i>Maybe</i> some of them made a call to their cold chain supplier and were told that there’s nothing to worry about.
I wonder how many people working in any given supermarket chain actually know that their fridges are connected to a network at all.
Not many, probably, but their cold chain people definitely would have known. Instrumented and remote monitored cold chains are standard these days because keeping stuff refridgerated end to end is a pretty big deal.
Their cybersecurity departments (next to fresh produce) are all over this.<p>Snark aside, supermarkets are not in the tech business. The extent of their involvement is ringing their IT vendor to complain about it.
I wouldn't be surprised if its their own agencies hacking these systems preemptively in order to force the issue and increase robustness against a larger multi-pronged attack.
Why isn't the brand of cooler or cooler-controller being named?<p>Was it a password break or an open admin console or SNMP or what?
<a href="https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012/" rel="nofollow">https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012/</a><p>The real issue is geniuses in food stores connecting to the open internet systems with 100K+ EUR of products exposed.<p>Remember, the 'S' in 'IoT' stands for Security.
In the attack on French supermarkets a few weeks ago, hackers pirated controllers mostly supplied by the Danish company Danfoss.
Multiple sources confirm that it's the same Danfoss problem this time, for example, <a href="https://www.hln.be/binnenland/centrum-voor-cybersecurity-bevestigt-aanval-op-koelinstallaties-in-belgische-supermarkten-maar-hoe-kan-dat~a9d993ad/" rel="nofollow">https://www.hln.be/binnenland/centrum-voor-cybersecurity-bev...</a> (in Dutch)
In France I believe that the password on the monitoring software, or the controllers, was updated daily. The date was somehow used as the new password, or as an input to the password sequence. So rolling the passwords didn't do anything when the attackers are aware of the "algorithm".
I wonder if the companies affected this time missed the news about the French attack a few weeks back?
The bizarre thing is it is the second time for Delhaize, although the incident of two weeks ago was related to the pricing system.
Imagine they where internet exposed due to simplicity. It will take longer than three weeks to set this up. Not for you but imagine you are a store owner with 0 IT knowledge.<p>The issue is this needs to be handled centrally by the parent org also. They have IT of course but they usually do POS and desktops/servers.<p>The OT/SCADA systems are usually totally separate and not touched by the white collar IT systems.
No joke, yes they did. The markets hit here in Sweden are all in rural communities with very low number of tech workers. They likely order their system from a supplier, that should have alerted them and helped them, but apparently did nothing.
But then the supplier is responsible, why would you ever put a fridge online if you are are tech noob. Someone told these people to put these fridges online, they didn't put an Ethernet cable in the back by themselves for the fun of it.
Some of them (Coop) got new equipment after what happened in France and where gonna upgrade them in two days.
>The markets hit here in Sweden are all in rural communities with very low number of tech workers.<p>Hej! You are wrong, here in the middle of Stockholm got hit.<p><a href="https://www.mitti.se/nyheter/icabutikens-frysar-hackades--fick-slanga-allt-6.3.394424.4854a6a166" rel="nofollow">https://www.mitti.se/nyheter/icabutikens-frysar-hackades--fi...</a><p>ICA Baronen on Odengatan is one of several stores in Sweden that have suffered a major hacker attack. On Monday, their freezers were cancelled at 50 degrees.<p>This is in Stockholm - <a href="https://maps.app.goo.gl/BwbDST4dPVkjcdgA8" rel="nofollow">https://maps.app.goo.gl/BwbDST4dPVkjcdgA8</a><p>So no lack of IT workers/tech workers... Nor is it very rural.<p>>They likely order their system from a supplier, that should have alerted them and helped them, but apparently did nothing.<p>The first thing to do when you get access to these as a hacker? You disable the alarms...!<p>Now, the supplier should have set them up correctly over VPN, good passwords, Zero Trust etc but these an OT/SCADA are usually just open to the internet due to the simplicity of use.
After the PHP vulnerability, we got some clients asking if our SaaS product used PHP (it didn't). It's possible that they just contacted their vendor, who assured them that everything was fine.
"Fool me once, shame on you, fool me twice, shame on me." But it should have been, like Bush said: "Fool me once, shame on — shame on you. Fool me — you can't get fooled again."
<a href="https://news.ycombinator.com/item?id=50335602">https://news.ycombinator.com/item?id=50335602</a><p><a href="https://news.ycombinator.com/item?id=50335252">https://news.ycombinator.com/item?id=50335252</a>
My fridge beeps loudly when something is wrong, and it has no connectivity to any network. Exactly how a fridge is supposed to be, why are we reinventing fridges…
Not officially at war (or even cyberwar) but... are we at war?<p>What sort of electronic shitfight is about to go down between major powers?
Why the previous attack wasn't a strong enough signal to make every European retailer unplug their freezers from the internet is a mystery to me.
Admin interface available on the internet without 2fa and automatic password change once a week? Anyone gaining sufficient experience and seniority in the industry becomes instantly unemployable, so it is what it is.
Two things:<p>1) I hope they learn some hard lessons about security and what should be exposed to the internet vs LAN.<p>2) These are some evil ass people doing this shit.
1) "They" have no idea what exposed to open internet vs LAN vs VPN even mean. They have no idea what these terms mean, they just want the easy access. Same reason why open RDP to 3389 used to be so common. Vendors install these so the store owner and them have easy access to alarms and controls. So they vendor installs it for easy access, shows the store owner, store owner trusts vendor, but vendor has done the bare minimum. Because the vendor wants it easy too.<p>A VPN per store would be too complex for the vendor so they just expose these to the open.<p>Same story as with all the hacked OT/SCADA systems in the past. Like those hacks where some SCADA system is open as a website with pump controls.<p>Imagine they where internet exposed due to simplicity. Imagine you are a store owner with 0 IT knowledge.<p>The issue is this needs to be handled centrally by the parent org also. They have IT ofc but they usually do POS and desktops/servers. The OT/SCADA systems are usually totally separate and not touched by the white collar IT systems.<p>2) Yes, obvious it is Russia doing this. Very handy to be able to disrupt food supply and they are also checking our response and time to restore.
Can't tell if it will be some asshole hacker group, Russia, the us, or what. But for the love of God please stop connecting everything to the Internet and also ai...
Isn't it a reasonable assumption that an LLM was involved in helping prepare this attack? §
Many would be thinking that, including me. Nefarious agents powered by LLMs operating 24x7 with a singular goal of finding attack vectors.
No I was just saying generally, the number of security risks do to AI is ridiculous
I have no problem with monitoring temps over internet.<p>Who ever thought it was OK to control freezers over the internet should be hung.
> Who ever thought it was OK to control freezers over the internet should be hung.<p>I've got really bad news for you about how many critical systems are connected to the Internet.
That implies you also ensure that they monitoring system is isolated from the control system. No one can be bothered to do that, and no one wants to spend the money on an extra microcontroller (a tiny fraction of the cost of each unit, but it comes straight out of your margin because no one pays extra for security).
Analytics are very different from controls. People who model them the same tend to suffer. A lot of academics and project managers don't understand this unfortunately.
...or ai lab bench maxxing.
[dead]
that's insane, they just got hit recently right?
The magic question is: why isn’t this fixed yet? And then the specifics, the nitty grift of why not. Thousands of industrial fridges. They presumably all need new hardware, or at least tenporarily all need a RPi with additional software on the network cable, or it could even worse… are they on regular company wifi? Don’t these companies have VLANs? It’s astonishing that this is what brings billion dollar companies in a key supply chain down.<p>This little gimmick cost Ahold in the Netherlands an estimated 300 M€ a few weeks back. Enough money for any firm to set the engineers to work? Where they waiting it out? Having read some more… another part of Ahold (the Belgian part) was hit and has (only now…) taken all fridges down from the internet. What is IT risk doing in a firm like that? Internet of Shit is a decade old. I am
not amazed non tech sectors are perhaps a bit slower in IT risk management. I am amazed that an ongoing attack situation can still cause trouble 4 months after publication and months after board level headline grabbing numbers are widely publicized.<p>Me and my crew (yet to form ;) will visit any fridge for a measly 100 K€ a pop to take them offline. Book early, because once the script kiddies hit, we are on the road.
Hackers remotely override settings on thousands of freezers, fridges and chiller cabinets, pushing them from as low as -27C to well over 50C. Intermarché, Coopérative U, Carrefour, Leclerc and Monoprix chains among those affected.