Ice Dream'
Level 2
After a similar incident in France, hackers targeted internet-connected supermarket refrigeration systems in Belgium and Sweden, affecting chains including Delhaize, Carrefour, Spar, ICA and Coop. Reports also suggest possible impact in Ireland, Estonia and the Netherlands.
The attack vector was simple but effective: remote access to connected refrigeration controllers, followed by activation of the defrost cycle and manipulation of temperature settings up to 50°C. The result was large-scale loss of frozen stock, likely worth millions.
At least 20 refrigeration units were reportedly affected in Belgium. In Sweden, staff discarded entire carts of spoiled products. Operators are now disconnecting affected units from the network and moving them to more secure connections; some vendors say hardware-level changes may also be required.
Some takeaways are... >
>>IoT/OT devices are often deployed with default credentials, outdated firmware, or unnecessary remote-access exposure.
*a compromised “smart” device can cause physical and financial damage, not just data exposure.
_practical mitigations: network segmentation, VLAN isolation for IoT/OT, firewall rules allowing only required traffic, MFA/VPN for remote maintenance, firmware updates, and disabling remote access when it isn’t needed.
This is a good reminder that cyber risk is no longer limited to servers, endpoints and cloud services — connected physical infrastructure is a real attack surface.
all this leads to inproper maintenance.
cited from: The so called supermarket attack
Legend: >>=important
*=vital but required
_=basics not met
The attack vector was simple but effective: remote access to connected refrigeration controllers, followed by activation of the defrost cycle and manipulation of temperature settings up to 50°C. The result was large-scale loss of frozen stock, likely worth millions.
At least 20 refrigeration units were reportedly affected in Belgium. In Sweden, staff discarded entire carts of spoiled products. Operators are now disconnecting affected units from the network and moving them to more secure connections; some vendors say hardware-level changes may also be required.
Some takeaways are... >
>>IoT/OT devices are often deployed with default credentials, outdated firmware, or unnecessary remote-access exposure.
*a compromised “smart” device can cause physical and financial damage, not just data exposure.
_practical mitigations: network segmentation, VLAN isolation for IoT/OT, firewall rules allowing only required traffic, MFA/VPN for remote maintenance, firmware updates, and disabling remote access when it isn’t needed.
This is a good reminder that cyber risk is no longer limited to servers, endpoints and cloud services — connected physical infrastructure is a real attack surface.
all this leads to inproper maintenance.
cited from: The so called supermarket attack
Legend: >>=important
*=vital but required
_=basics not met
