Hackers disrupt refrigeration systems at ICA and Coop supermarkets across Sweden, freezer reaches 55°C
Refrigeration systems at several ICA and Coop supermarkets across Sweden were disrupted by hackers, destroying perishable stock and forcing temporary closures. One store manager in Böda, Öland, found a freezer at 55°C. Affected stores span Skåne, Öland, Värmland and reportedly Stockholm, plus six Coop stores in Gästrikland and Hälsingland (per SVT). The incident follows similar attacks on French supermarket refrigeration and a reported Estonian case with remotely altered +50°C settings, but no link has been established.
Detalhes técnicos
- ICA says the affected refrigeration systems were connected independently of its central network.
- No exploited vulnerabilities, malware families, controller models or threat actors have been identified.
- It is unconfirmed whether set points, defrost cycles or cooling were manipulated.
- Separate research on Copeland commercial refrigeration controller flaws showed cooling can be disabled while normal temperatures are displayed. No evidence links those flaws to the Swedish incidents.
- Investigators still need to determine the initial access method and whether the stores share a refrigeration supplier, maintenance provider or remote-management infrastructure.
Remediação
- Restrict management access to internet-exposed OT.
- Enforce multifactor authentication.
- Segment control networks.
- Monitor configuration changes.
- Deploy independent temperature alarms and continuous monitoring.
Sweden's National Cybersecurity Centre (part of FRA) is assisting the affected organizations.
Linha do tempo
-
Hackers disrupt refrigeration systems at ICA and Coop supermarkets across Sweden, freezer reaches 55°C
ler a análise desta fonte ocultar
Refrigeration systems at several ICA and Coop supermarkets across Sweden were disrupted by hackers, destroying perishable stock and forcing temporary closures. One store manager in Böda, Öland, found a freezer at 55°C. Affected stores span Skåne, Öland, Värmland and reportedly Stockholm, plus six Coop stores in Gästrikland and Hälsingland (per SVT). The incident follows similar attacks on French supermarket refrigeration and a reported Estonian case with remotely altered +50°C settings, but no link has been established.
Technical Details
- ICA says the affected refrigeration systems were connected independently of its central network.
- No exploited vulnerabilities, malware families, controller models or threat actors have been identified.
- It is unconfirmed whether set points, defrost cycles or cooling were manipulated.
- Separate research on Copeland commercial refrigeration controller flaws showed cooling can be disabled while normal temperatures are displayed. No evidence links those flaws to the Swedish incidents.
- Investigators still need to determine the initial access method and whether the stores share a refrigeration supplier, maintenance provider or remote-management infrastructure.
Remediation
- Restrict management access to internet-exposed OT.
- Enforce multifactor authentication.
- Segment control networks.
- Monitor configuration changes.
- Deploy independent temperature alarms and continuous monitoring.
Sweden's National Cybersecurity Centre (part of FRA) is assisting the affected organizations.