Cooling problems at some Delhaize stores in Belgium and Luxembourg have highlighted how internet-accessible refrigeration controls can expose grocers to operational risks, even as the company has not confirmed a cyberattack.
Delhaize said it had been working to resolve an IT incident since Oct. 11. Cooling problems began at some stores on Monday, Nov. 2, and the retailer attributed them to that incident. The affected locations responded quickly and remained open. The company did not say how many stores were affected or explain how the IT incident began.
The Danfoss AK-SM 800A uses a web interface that lets operators monitor and configure refrigeration equipment. Claroty’s Team82 research says engineers can also troubleshoot the system remotely, without traveling to each installation. That access can help with maintenance, while also making the controls reachable beyond the store if the interface is exposed online.
A Claroty research post published Aug. 9 included a Censys graphic showing 2,765 Danfoss AK-SM 800A devices exposed to the public internet. The post did not give the scan date or identify device owners, so the figure is an exposure count, not a tally of attack victims. Amir Zaltzman, a vulnerability researcher at Claroty’s Team82, said, “Numerous controllers were directly accessible from the public Internet.”
France’s Computer Emergency Response Team (CERT-FR) said in an alert issued Oct. 12 and updated Oct. 16 that it knew of numerous compromises involving Danfoss AK-SM and AK-SC, Copeland XWEB and Dixell XWEB controllers. It advised removing internet access and limiting management interfaces to a secure VPN or protected network. For Danfoss equipment, the alert’s manufacturer best-practice guidance also included firmware updates and replacing default passwords.
Claroty separately reported an authentication bypass, a command-injection flaw and a web-server configuration issue in the AK-SM 800A interface. It said firmware R4.3.1 addressed the findings. Claroty said its identified vulnerabilities had not been officially tied to the reported attacks, and Delhaize did not link its IT incident to them. EconoTimes previously covered a lab reproduction of known freezer-control flaws.
Claroty said grocery retailers initially bear inventory losses when refrigeration settings are manipulated, estimating immediate losses of €50,000 to €270,000 per site. It did not provide an aggregate total.
