Red Team

Follow-up: fridge sabotage wave returns, NCSC warns UK firms

A second wave of freezer sabotage hit stores in six countries, including 13 SuperValu shops. The NCSC says UK firms were alerted and some hit.

Warning symbol over a supermarket freezer aisle representing the refrigeration sabotage attacks

A second wave of refrigeration sabotage hit supermarkets in at least six European countries overnight on 1 to 2 November, forcing freezers to warm until stock was ruined. The NCSC says it spent the night warning UK organisations with exposed controllers and believes a couple of them have been affected.

What happened

Between late on Sunday 1 November and the early hours of Monday 2 November, attackers reached the systems that run supermarket chillers and freezers and drove their temperatures up while stores were closed. By morning, display cases read around 50C, with some reports putting the peak at 55C.

Ahold Delhaize described an “IT incident” affecting refrigeration in several dozen stores, mostly in Belgium with a handful in Luxembourg, and said its distribution centres were not touched. Carrefour Belgium put its count at 15 of more than 700 stores. TechForum reports that five Spar shops run by Colruyt Group and one IKEA store in Belgium were also caught up. In Sweden, ICA said a “limited number” of stores were affected and Coop put its count at six or seven, depending on the report. Estonia’s Selver chain had one outlet hit, and the equipment maker there, Kitman Coldtech, said it contained the intrusion within minutes. Further incidents were reported in the Netherlands.

The closest case to home is in Ireland. Musgrave, which owns SuperValu, said 13 stores, including branches in Waterford, Lucan, Blanchardstown and Bray, pulled chilled and frozen products from sale as a precaution after a cyber incident confined to one specific refrigeration model. Musgrave has not said which model.

On the morning of 3 November, NCSC chief executive Dr Richard Horne told BBC Radio 4’s Today programme that his teams had been contacting UK organisations overnight where they could see vulnerable, internet-exposed technology. He said “handfuls” had been alerted and added that the NCSC was “aware of a couple of impacts, we think”, according to the Mirror’s report of the interview. On attribution he was blunt: “It’s too early for us to say,” he said, adding that states or criminals could be behind it. No UK victims have been named.

All this comes three weeks after the attack on French supermarkets on the night of 11 to 12 October. That wave hit around 700 stores, according to France’s finance minister, and prompted a CERT-FR alert on exposed controllers, which secnews.co.uk covered at the time.

The technical picture

The method appears identical to October. Stephan Moelans, chief executive of the Belgian refrigeration installer Sabcobel, told the Belga news agency that the intruders switched the evaporators into defrost mode remotely. That cycle is meant to warm the coils briefly and clear ice; override the limits that end it and the cabinet just heats up. Nothing is encrypted: a legitimate function is turned against the business.

The pattern of victims says a lot about how they were reached. Where chains gave network sizes, the hit rates were tiny: roughly 2 per cent of Carrefour’s Belgian estate and under 1 per cent of Coop’s Swedish shops. Sabcobel said it knew of about 20 affected units out of the hundreds it maintains. A breach of a retailer’s central IT would be expected to touch far more sites at once. A thin, scattered spread across many chains points instead to someone picking off individual store controllers left exposed online. Sabcobel’s engineers ended up unplugging units from the network by hand overnight.

No group has claimed responsibility and there has been no ransom note, data theft or extortion demand. Belgium’s Centre for Cybersecurity has said the culprit may never be identified. Investigators have not confirmed which weakness was used this time.

Timeline of the October and November supermarket refrigeration attacks and the NCSC response

Why it matters for UK organisations

This is no longer a continental story that UK retailers can watch from a distance. The NCSC’s own words confirm that the same class of exposed refrigeration kit exists in UK premises, that it has been contacting owners, and that it thinks a small number of UK incidents have already happened. The SuperValu cases bring the attack into a neighbouring market closely tied to the UK’s.

The exposure is not limited to the big four grocers. Convenience stores, wholesalers, cold stores, food manufacturers, hospitals and pharmacies all run similar supervisory controllers. Many of those controllers are installed and remotely managed by third-party refrigeration contractors, which means the retailer’s IT and security teams may not know they exist, never mind that they are online. Horne himself warned that the risk extends across the food supply chain and into wider operational technology, much of it kept running past its supported life.

Expert view

When we test retail and logistics estates, building management and refrigeration controllers are among the most commonly forgotten assets. They tend to arrive with the shopfitter, sit on a flat network or behind a contractor’s 4G router, and keep a web interface open so an engineer can check alarms from a van. They are rarely in the asset register or the test scope.

What strikes me about this campaign is how little sophistication it needs. The attacker does not have to escalate privileges across a domain or evade an EDR agent. They need to find an interface, get past whatever authentication it has, and press a button the device was designed to offer. That is exactly why the ceiling of the damage is set by safety engineering rather than by IT security. A freezer that will accept a command to sit at 50C for hours has no sensible physical interlock. In my experience the fix that actually lasts is a mix of removing internet exposure and adding hard limits the controller cannot override, not just another firmware update on hardware that is out of support.

Two waves three weeks apart, with no visible financial motive, deserve to be treated as a rehearsal until proven otherwise.

What to do now

  1. Find every refrigeration and building controller you own or that a contractor manages for you. Ask your refrigeration maintainer for a list of units, firmware versions and remote access routes.
  2. Take management interfaces off the internet today. If a controller is reachable from the public internet, disconnect or filter it now and move remote access behind a VPN or a contractor jump host with multi-factor authentication. (Cyber Essentials: firewalls).
  3. Check configurations, not just reachability. Review defrost schedules, set points, alarm thresholds and user accounts against a known-good baseline.
  4. Change default and shared credentials on controllers and remove accounts that are no longer needed (Cyber Essentials secure configuration and user access control).
  5. Plan to replace end-of-life units. Unsupported hardware fails the Cyber Essentials security update control.
  6. Make sure alarms reach a human at night. Both waves ran while stores were shut. Temperature alerts should page someone who can act.
  7. Report incidents to the NCSC and respond to any NCSC alert about exposed systems straight away.

Bottom line

A second, wider wave of freezer sabotage has shown that the October attack in France was not a one-off, and the NCSC now believes UK organisations have been touched. Any UK business with a cold chain should find its refrigeration controllers this week and get them off the open internet.

Sources

Related Posts