Cyberattack hits ICA fridges in Sweden: freezers at 50°C

Cyberattack hits ICA fridges: freezers at 50 degrees

A cyberattack has struck through the door of the cold chain. The Swedish supermarket chain ICA, one of the largest in the country, has acknowledged that several of its stores suffered an overnight cyberattack that left fridges and freezers with the thermostat cranked up to 50°C. According to the information released, the result points to large quantities of food lost. This is not a breakdown. It is a remote hand playing with the thermostat of half a country's fridges.

The Swedish episode did not come alone. Over the course of the same day, more hotspots emerged: Belgium with more than 40 Delhaize stores, 15 Carrefour stores and around five Spar stores with problems in their refrigeration systems, and Estonia as the latest country affected by a similar pattern. Luxembourg is mentioned in the same sequence. The picture is starting to look less accidental than it seems.

What is known about the attack on the cold chain

The available account is sparse and should not be embellished. The attackers would have gained access to the control system of a major supermarket chain and from there remotely manipulated the temperature of the equipment. The immediate consequence is not a blackout or a ransomware data hijack: it is a frozen food aisle turned into a slow oven, with product that has to be withdrawn.

The cold chain is one of those systems nobody looks at until it fails. One extra degree sustained for hours is enough to ruin entire batches. Here we are not talking about one degree: we are talking about 50°C in equipment designed to operate below zero. The bill is measured in tonnes of food and in the trust of customers who go home with a bag that should no longer be on sale.

From one fridge to an international pattern

The geographical sequence is the most uncomfortable part of the story. Sweden, Belgium, Luxembourg, Estonia. Four countries in a single day with the same type of target: supermarket refrigeration. It could be a coordinated group, a script reused by copycats, or a demonstration of capability. None of these hypotheses is confirmed.

What is on the table is evidence of an enormous attack surface. Supermarkets have been connecting thermostats, alarms and control systems to the network for years to save on maintenance and staff. That efficiency has a price: every connected device is a door. And sometimes doors are left open.

The internet of things reaches the fridge

The conversation this episode leaves behind points to something bigger than ICA. If you can move the thermostat of a freezer, you can touch the one in a truck, a warehouse or a hospital. The question is no longer whether the internet of things has security flaws, but how many of those flaws are installed in infrastructure that basic supply depends on.

Some argue these incidents are anecdotal, taken one by one. The counterargument weighs against it: the coincidence of countries and method suggests a rehearsal, not chance. And a rehearsal, when it goes well, is repeated on a larger scale.

---

The analysis stalls right where it gets interesting: nobody has yet explained who is behind this or what they intend. Meanwhile, the fridges remain connected.