Yevropaning bir nechta mamlakatlaridagi supermarket tarmoqlari tomonidan boshqariladigan do'konlarda sovutish tizimlariga kiberhujum natijasida xakerlar muzlatgichlar va sovutish tizimlarining harorat sozlamalarini masofadan o'zgartirgandan so'ng, do'konlar faoliyati buzildi.
Ba'zi hollarda xakerlar muzlatgichlarni o'chirib qo'yishdi yoki muzdan tushirish tizimlarini faollashtirishdi, bu esa haroratning ko'tarilishiga, mahsulotlarning sezilarli yo'qotilishiga va do'kon menejerlarining erta tongda aralashuviga majbur bo'lishiga olib keldi.
Sovutish tizimlaridagi nosozliklar o'nlab supermarketlarda aniqlangan, ammo ular muvofiqlashtirilgan hujum natijasida yoki alohida nishonga olinganligi aniq emas.
Belgiya, Niderlandiya, Shvetsiya, Lyuksemburg, Irlandiya va Estoniyada 115 dan ortiq do'kon zarar ko'rgan. Bir nechta tarmoq vakillari BleepingComputer nashriga bergan bayonotlarida muammolarni tasdiqlashdi.
Sovutish tizimidagi muammolarni tan olgan supermarket tarmoqlari:
- ICA (Shvetsiya) — Kamida 4 ta joy zarar ko'rgan
- Coop (Shvetsiya) — 7 ta joy tasdiqlangan
- Ahold Delhaize (Belgiya va Lyuksemburg) — Taxminan 40 ta joy zarar ko'rgan
- Carrefour (Belgiya) — 15 ta joy zarar ko'rgan
- Spar Colruyt (Belgiya) — 5 ta joy zarar ko'rgan
- Intermarché (Belgiya) — Taxminan 15 ta joy zarar ko'rgan
- SuperValu (Irlandiya) — 13 ta do'kon
- Selver (Estoniya) — 1 ta do'kon
Niderlandiyada kamida 17 ta qassob do'koni va mahalla do'konlari zarar ko'rgan.
Belgiya shahrida qo'shimcha do'konlar ham xuddi shu muammolarga duch kelmoqda, jumladan Mons shahridagi Ikea superdo'koni, oziq-ovqat do'konlari va shokolad do'konlari.
ICA, Ahold Delhaize va Spar Colruyt vakillari BleepingComputer nashriga o'z kompaniyalari zarar ko'rgan do'konlarga yordam ko'rsatayotganini va vaziyatni hal qilish ustida ishlayotganini aytishdi.
"Biz ICA markaziy tarmog'idan tashqarida ishlaydigan kichik sonli ICA do'konlariga ta'sir qilgan hodisa haqida xabardor qilinganligimizni tasdiqlaymiz", — dedi ICA matbuot kotibi.
"Hodisa do'konlarning sovutish va muzlatish tizimlariga ta'sir qildi. ICA hozirda zarar ko'rgan do'konlarga vaziyatni boshqarishda yordam bermoqda."
Colruyt Group vakili BleepingComputer nashriga "taxminan beshta Spar do'konidagi sovutish tizimlariga ta'sir bor" deb aytdi.
"Ushbu do'konlar o'z sovutish tizimlariga ega bo'lgan mustaqil tadbirkorlar tomonidan boshqariladi. Hozirda biz muammoni hal qilish uchun qo'limizdan kelgan hamma narsani qilmoqdamiz."
BleepingComputer nashriga bergan bayonotida Ahold Delhaize bir necha o'nlab do'konlardagi sovutish tizimlari IT hodisasi natijasida zarar ko'rganini aytdi.
"Biz bir necha o'nlab do'konlardagi sovutish tizimlariga ta'sir qilgan IT hodisasini aniqladik", — dedi kompaniya aloqa bo'limi, qo'shimcha qilib, kompaniya "do'konlarimizni ishlashda saqlab qolish uchun darhol zarur choralarni ko'rdi".
Shvetsiyadagi eng yirik oziq-ovqat do'konlari tarmoqlaridan biri bo'lgan Coop vakili sovutish qurilmalari kichik sonli do'konlarga ta'sir qilganini va bir holatda tizim issiqlik ishlab chiqarishni boshlaganini aytdi.
"Biz dushanbaga o'tar kechasi kichik sonli do'konlarga ta'sir qilganini tasdiqlaymiz — aniqrog'i, 800 dan ortiq do'konlardan 7 tasi", — deb aytdi Coop BleepingComputer nashriga.
"Vaziyat hozirda nazorat ostida va boshqarilmoqda. Muammolar to'liq o'chirilgan muzlatgichlar va muzlatish tizimlaridan qisman ishlaydigan qurilmalargacha, va bir holatda tizim issiqlik ishlab chiqarishni boshlaganigacha bo'lgan."
Belgiya shahrida faqat ikkita mintaqadagi Carrefour do'konlari zarar ko'rgan va barcha gipermarketlar to'liq ishlashda qolgan.
"Carrefour'dagi ta'sir juda cheklangan: hozirda 700 ta do'konimizdan 15 tasi zarar ko'rgan, ham Flandriya, ham Valloniya mintaqalarida", — deb aytdi Carrefour.
"Ular orasida birorta ham gipermarket yo'q. Barcha do'konlar ochiq qolmoqda, chunki bu faqat bir nechta sovutish qurilmalariga, asosan muzlatgichlarga taalluqli. Barcha do'konlar ochiq qolishi uchun tezkor choralar ko'rildi."
ICA do'kon menejeri TV4 telekanaliga harorat sozlamalari kechasi +50°C (122°F) ga o'zgartirilganini va ularni o'zgartirish mumkin emasligini, bu esa do'konni muzlatilgan oziq-ovqatni tashlab yuborishga majbur qilganini aytdi.
RTL media nashriga ko'ra, Ahold Delhaize menejerlarga sovutish tizimidagi muammolar haqida soat 4 atrofida SMS orqali ogohlantirgan va ba'zi do'konlar zaxiralarni saqlab qolish uchun sovutish yuk mashinalaridan foydalanishgan.
Nashr shuningdek, zarar ko'rgan bir nechta joylardagi sovutish tizimlarining yetkazib beruvchisi sifatida Sabcobelni aniqlagan.
Sabcobel direktori Stephan Moelansning aytishicha, hujumchi o'tgan oyda Fransiyada sodir bo'lgan shunga o'xshash hujumlarda ishlatilgan xuddi shu zaiflikdan foydalangan.
Moelans texniklar 1:00 dan boshlab zarar ko'rgan qurilmalarni uzishni boshlaganini va buzilishni masofadan faollashtirilgan muzdan tushirish funksiyalariga bog'laganini aytdi.
Garchi kompaniya mijozlar tizimlarini himoya qilishga harakat qilgan bo'lsa-da, oddiy dasturiy yangilanish yetarli emas, chunki muzlatgichlar jismoniy o'zgartirishlarni ham talab qiladi.
"Eng oddiy yechim — muzlatgichlarni xavfsiz internet ulanishi orqali boshqarish. Fransiyadagi hujumdan so'ng mijozlarimizning aksariyati ushbu yechimni qabul qilishdi", — deb aytdi Moelans RTL nashriga.
BleepingComputer nashri Sabcobel bilan bog'lanib, hodisa va uning ishtirok darajasi haqida ko'proq ma'lumot olishga harakat qilgan, ammo biz hali ham javob kutmoqdamiz.
O'tgan oyda Fransiyada sodir bo'lgan muzlatgich hujumlari Danfoss AK-SM/AK-SC va Copeland/Dixell XWEB sovutish nazoratchilaridan foydalanadigan yuzlab do'konlarga ta'sir qilgan, ular masofadan hujumchilar tomonidan muzdan tushirish rejimiga o'rnatilgan.
Mavjud himoyalaringiz o'tkazib yuborishi mumkin bo'lgan elektron pochta tahdidlarini aniqlang.
Adaptive Security'ning AI agentlari elektron pochta niyatini, kontekstini va xulq-atvorini tahlil qilib, fishing, biznes elektron pochta buzilishi va hisob-faktura firibgarligini aniqlaydi.
Microsoft 365 yoki Google Workspace'ning 14 kunlik faqat o'qish skaneri bilan MX o'zgarishlarsiz nima o'tib ketayotganini ko'ring.
Bepul elektron pochta xavfsizligi skaneringizni boshlang.
A cyberattack on refrigeration systems has disrupted stores run by multiple supermarket chains across several European countries after hackers remotely changed temperature settings on freezers and cooling systems.
In some cases, hackers shut down refrigerators or activated defrosting systems, causing temperatures to rise, resulting in significant product losses and forcing store managers to intervene early in the morning.
Refrigeration failures were identified at dozens of supermarkets, but it is unclear whether they were hit in a coordinated attack or targeted individually.
More than 115 stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia have been affected. Spokespersons for multiple chains confirmed the issues in statements for BleepingComputer.
Supermarket chains that acknowledged refrigeration issues include:
- ICA (Sweden) - At least 4 locations affected
- Coop (Sweden) - 7 locations confirmed affected
- Ahold Delhaize (Belgium and Luxembourg) - Around 40 locations affected
- Carrefour (Belgium) - 15 locations affected
- Spar Colruyt (Belgium) - 5 locations affected
- Intermarché (Belgium) - Around 15 locations affected
- SuperValu (Ireland) - 13 stores
- Selver (Estonia) - 1 store
In the Netherlands, at least 17 butcher shops and neighborhood stores have been affected.
Additional stores are dealing with the same problems in Belgium, including an Ikea superstore in Mons, grocery stores, and chocoloate shops.
Spokespersons for ICA, Ahold Delhaize, and Spar Colruyt told BleepingComputer that their companies are providing support to affected stores and working to resolve the situation.
“We can confirm that we have been informed of an incident overnight affecting a small number of ICA stores operating outside ICA’s central network,” stated ICA’s press officer.
“The incident impacted the stores’ refrigeration and freezer systems. ICA is currently supporting the affected stores in managing the situation.”
A representative of the Colruyt Group told BleepingComputer that "there is an impact on the refrigeration systems at around five Spar stores."
"These stores are operated by independent entrepreneurs who have their own refrigeration systems. We are currently doing everything we can to resolve the issue."
In a statement for BleepingComputer, Ahold Delhaize stated that refrigeration systems at several dozen stores have been impacted by an IT incident.
“We have identified an IT incident affecting the refrigeration systems in several dozen stores,” the company's communications department said, adding that the company "immediately took the necessary measures to keep our stores operational."
A spokesperson for Coop, one of the largest grocery store chains in Sweden, said that refrigeration units at a small number of stores were impacted, and in once case the system started to generate heat.
"We can confirm that a small number of stores were affected overnight into Monday - specifically 7 out of more than 800 stores," Coop told BleepingComputer.
"The situation is currently contained and under control. The issues have ranged from completely shut-down refrigerators and freezers to partially functioning units, and in one case, the system beginning to generate heat."
In Belgium, only Carrefour stores in two regions were affected, and all hypermarkets remained completely operational.
"The impact at Carrefour is very limited: currently 15 of our 700 stores are affected, both in Flanders and Wallonia," Carrefour stated.
"Not a single hypermarket is among them. All stores remain open because it only concerns a few refrigeration units, mainly freezers. Quick action was taken so that all stores can stay open."
An ICA store manager told TV4 that temperature settings had been changed overnight to +50°C (122°F) and could not be modified, forcing the store to discard frozen food.
According to RTL media publication, Ahold Delhaize warned managers by SMS around 4 a.m. about refrigeration issues, and some stores used refrigerated trucks to try to preserve stock.
The publication also identified Sabcobel as the vendor of refrigeration systems across several of the impacted locations.
According to Sabcobel's director, Stephan Moelans, the attacker leveraged the same vulnerability used in similar attacks last month in France.
Moelans said that technicians started disconnecting affected installations since 1a.m. and attributed the disruption to remotely activated defrost functions.
Although the company tried to protect customer's systems, a simple software update is not enough, as refrigerators also require physical modifications.
"The simplest solution is to manage the refrigerators via a secure internet connection. Most of our clients have adopted this solution since the attack in France," Moelans told RTL.
BleepingComputer has contacted Sabcobel to learn more about the incident and its level of involvement, but we are still waiting for a response.
Last month's refrigerator attacks in France impacted hundreds of stores using Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB refrigeration controllers that were compromised by remote attackers who set them to defrost mode.
Uncover email threats your existing defenses may miss.
Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
Start your free email security scan.