The High Price of Unpatched Thermostats

Modern European retail has spent years trumpeting the virtues of internet-connected infrastructure, yet it appears few took the trouble to install basic software patches. Supermarket chains in Sweden, Belgium, and Luxembourg recently discovered that centralising control over food preservation yields predictable vulnerabilities when routine maintenance is neglected.

The latest disruption saw temperatures rise in refrigerators and freezers across dozens of retail locations overnight. In Sweden, six stores belonging to the Coop chain were affected, alongside a limited number of outlets operated by ICA. Ahold Delhaize, the Dutch retail giant that had previously reported a cybersecurity incident to police in the Netherlands, acknowledged that an IT incident had struck cooling systems across its Belgian and Luxembourgian network. The disruption reached deep into local supply points, hitting five Spar outlets, Proxy Delhaize minimarkets, and several Shop & Go convenience stores situated at Q8 service stations. Technicians from refrigeration specialist Sabcobel spent the early morning hours physically disconnecting compromised installations from the electrical grid.

This incident follows a far larger disruption in France, where hackers hijacked cooling units at up to 700 supermarkets. Chains including Carrefour, Leclerc, Intermarché, Monoprix, and Coopérative U suffered extensive losses after perpetrators remotely altered control settings, pushing cabinet temperatures from minus 27 degrees Celsius to over 50 degrees.

The economic damage from these operational failures accumulates quickly. French retailers were forced to discard vast quantities of fresh meat, dairy, and frozen stock, with single-store losses frequently exceeding 130,000 euros. In Alsace, just two affected branches logged combined damages of 270,000 euros. Formal investigations opened by the Paris prosecutor’s office noted that the attacks caused both food destruction and fires, prompting Prime Minister Sébastien Lecornu to deploy the national cybersecurity agency ANSSI.

The root of the system failure lies in connected controllers manufactured by Danish firm Danfoss, as well as hardware from two additional suppliers identified by ANSSI. Danfoss had discovered security flaws in its devices last year and explicitly advised clients to execute necessary updates. That European grocery networks ignored these warnings until their freezers began actively cooking their own inventory demonstrates a familiar pattern of corporate administrative inertia.

Written by Thorben Thiede thorben.thiede@alpineweekly.com