Cyberattack hits European supermarket freezers: the flaw already flagged in October

Freezers at 50 degrees: the cyberattack that was warned about and nobody stopped

How do you raise a freezer to 50 degrees without touching it? With a remote control and a door open to the internet. Sweden's two biggest supermarket chains, Ica and Coop, confirmed early on a Monday that they had suffered a cyberattack that pushed the freezer temperature in dozens of stores up to 50 degrees, according to the facts laid out in the opening of this discussion. The same modus operandi as the mass attack on French supermarkets in mid-October. The head of Sweden's Cybersecurity Centre, John Billow, admitted after the incident that it «demonstrates the vulnerability we have with so many connected devices, it is a big problem», and avoided naming culprits.

The pattern repeats across half of Europe. More than fifty Delhaize and Carrefour supermarkets in Belgium, a butcher chain present only in Antwerp, at least 13 SuperValu stores in Ireland, 17 establishments in the Netherlands, shops in Finland, Luxembourg and one supermarket in Estonia. The temperature rise peine in the middle of the night: products were left exposed for hours and, on opening, staff could only confirm they were lost.

How a freezer heats up to 50 degrees

The first logical reaction is disbelief. A refrigeration machine does not heat. The technical detail that dismantles that intuition lies in the defrost cycle: every so many hours of operation, the evaporators of refrigerated units remove accumulated ice using hot gas, water or heating elements, and during the process the fans stop so as not to push hot air inside. That is the sustancia ilegal. If someone switches on the heating element or reverses the four-way valve — the same principle as a domestic heat pump — and leaves the fans running, hot air enters the unit. Given enough time, the evaporator reaches 50 or 60 degrees, according to a calculation circulating in the discussion. No army is needed: only a system that can be manipulated from outside.

The design flaw: monitor yes, control no

The most repeated criticism points at the design, not the attacker. A freezer connected to the internet should serve to monitor temperature and raise an alarm, not to receive commands. If the alert goes off, someone walks over and checks. The problem is that the alert can be hacked too: if the attacker controls the program that raises it, it stops raising it. And there is a galling aggravating factor: the same strike had been recorded weeks earlier in France and other countries, and the owners of the affected chains reportedly took no action, as claimed in the discussion. From there to thinking someone is defrauding the insurer is a stretch, but the reasoning has taken hold in the conversation.

The internet of things, for show

The label «internet of things» stands exposed: connected devices meant to save a site visit, turned into the way in. The discussion drifted into context: a train on the Madrid-Valencia line, the irrigation sprinklers during the flooding, the feeling that everything fails at once. Also into the immediate future, with AI-generated code heading towards 70 or 80 percent of what gets pushed to production, according to a circulating estimate. The technical conclusion is boring and blunt: an old-fashioned thermometer hooked up to an intranet would have done the same job without opening the front door.

In the end, the question left standing is not who hacked, but why nobody closed the door after the first warning. And the answer, for now, is a freezer at 50 degrees.