When the Freezer Becomes the Attack Surface

Hackers turned ICA and Coop freezers into ovens overnight, and the way in was a supplier's login, not the stores themselves.

The first I heard of it was a news alert on a Monday morning in early November. Here in Stockholm, life looked normal. My local supermarket had the same humming freezers, the same frost on the glass, the same overpriced ice cream I always tell myself not to buy. But the headlines described stores in Skåne and Öland that had opened to freezers reading 50 degrees and staff throwing out trolleys of spoiled food. I was surprised. I had filed this kind of attack under things that happen elsewhere, in France, not here. One night proved me wrong, and reminded me that being spared this time is not the same as being prepared.

The news.

Overnight into Monday 2 November, refrigeration and freezer systems at ICA and Coop stores across Sweden were manipulated. One store manager told SVT the system had been switched to defrost mode. At ICA Kvantum in Sjöbo, food worth hundreds of thousands of kronor was destroyed, according to TV4. Cases were reported in Skåne, Öland, Värmland, Stockholm, Gästrikland and Hälsingland, and an Ikea store was affected as well. ICA said its central systems were untouched, because the controls came from an external supplier and sat outside ICA's own network.

The spread.

Sweden was not alone. The same night, supermarkets in Belgium, Estonia, Finland, Ireland, Luxembourg and the Netherlands reported similar failures. Nobody has claimed responsibility, and Sweden's National Cyber Security Centre has not named a culprit. None of this came out of nowhere either. On 11 and 12 October, hundreds of French supermarkets were hit in the same way. John Billow, head of the National Cyber Security Centre at FRA, told SVT that devices in the French cases were protected by very simple passwords and no multifactor authentication. Fredrik Blix, a cybersecurity researcher at Stockholm University, called the Swedish incident a failure, because the risk was known weeks earlier and should have been acted on.

The blind spot.

Billow made another point that deserves more attention than it got. Operational technology, the systems that run physical equipment, has received far less security attention in Sweden than office IT. Retailers spend heavily protecting tills, card data and customer accounts. A freezer controller that a service company reaches over the internet gets filed under facilities, not cyber. That is how a chain with serious IT security can be beaten through a cabinet full of fish fingers.

The pattern.

Swedish shoppers have seen this film before. In July 2021, Coop had to close most of its roughly 800 stores for a weekend after ransomware hit Kaseya, a software supplier behind its checkout provider. Different technology, same shape. The attacker never needed to touch Coop directly. Every large Swedish chain now runs on a web of outside vendors for payments, logistics, energy and cooling, and each of those links is a door someone else holds the key to.

My read.

I spend my working days on risk and controls, so I'll say it plainly: this was a third-party risk failure before it was a hacking story. Most vendor contracts I have read cover price, uptime and response times. Far fewer say how the vendor's remote access is secured, who holds the passwords, or whether multifactor login is mandatory. Those are dull clauses, and nobody asks for them until the freezers hit 50 degrees. I don't think the fix is expensive. A firewall rule, a changed default password and one extra question in the annual supplier review would have stopped most of this. The hard part is admitting that the freezer belongs on the risk register.

Watch this.

Blix named laboratories and pharmacy fridges as the next places to check, and Billow mentioned the energy sector. I would add every Swedish company that has signed a service contract with remote access included. The question for boards this winter is simple. Who else can log in to our building?

 

FAQs:

1. Was my local supermarket affected, and is the food safe now?

A: Only a limited number of ICA and Coop stores were hit, and affected stock was thrown away. The stores reopened after removing spoiled goods.

 

2. Was this really a cyberattack, or just a technical fault?

A: ICA confirmed an incident with its refrigeration systems but had not formally confirmed a cyberattack, while at least one store and several experts described it as hacking. Nobody has claimed responsibility.

 

3. Why would anyone attack freezers?

A: The motive is unknown. What is clear is that internet-connected cooling systems with weak passwords are easy to find and easy to manipulate.

 

4. Is this only a supermarket problem?

A: No. Experts quoted by SVT pointed to laboratories, pharmacy fridges and the energy sector as areas with similar exposed systems.

 

5. What should companies do now?

A: Check which equipment is reachable from the internet, remove access that is not needed, and require strong passwords and multifactor login from every supplier with remote access.