A warehouse in Ytre Enebakk, in Norway's Akershus county, suffered a suspected cyber intrusion overnight into Tuesday, according to NRK. Someone appears to have entered the controls of the store's freezer facility and instructed the system to raise temperatures in the evaporator or defrost unit, the broadcaster reports. The resulting heat set off the sprinkler system in the freezer room, causing water damage and losses to stored food.
The outlet is Havaristen, a roughly 3,000-square-metre facility. Thomas Michelsen told NRK that staff rushed out to salvage what they could and pull goods from the affected area. He described the damage as considerable in scope, adding that the impact was smaller than it would have been had a single small freezer counter been involved.
Why it matters
The incident fits a pattern that has unsettled food retailers across the continent. NRK reports that several hundred grocery stores in Europe have been hit by cyberattacks in recent days. In Sweden, Belgium, Luxembourg and France, temperatures in freezing and refrigeration equipment were reportedly raised so high that entire stocks of food had to be thrown away.
The case also highlights a less-discussed exposure: the operational technology that runs physical equipment such as cooling systems, rather than the office networks most companies focus their defences on. A single unprotected connection point was enough to reach machinery that controls temperature.
Norway's National Security Authority (NSM) told NRK it was not aware of the Havaristen incident but said a confirmed hack would be serious. NSM director Arne Christian Haugstøyl said such an attack harms the warehouse concerned and likely destroys a quantity of food. He also stressed that an intrusion against one facility does not threaten national food or supply security.
An external sender outside the firewall
Michelsen initially assumed a fire had started and that the sprinklers had engaged as a result, possibly melting something on the evaporators. That changed after contact with the equipment supplier, which he said provided strong indications of an intrusion.
The store operates a number of freezers, but the others are connected to a different system from the one affected. While the rest of the installation sits behind the company's own firewall, the freezer room in question was linked through an external 4G transmitter. Michelsen said the supplier had been able to control the system remotely when faults arose, and that someone evidently gained access through that transmitter, based on the information he has.
He acknowledged the company had spent time and money on internal security but said the issue demands more follow-up than might be assumed, even though it is on the agenda. The presence of an unprotected transmitter had not been known to them, he said, and he suggested the lesson from coverage of similar attacks could have been absorbed sooner.
The fire service was dispatched to the site at 03:11, according to Martin Hereid Kristiansen, duty commander at the 110 central for eastern Norway. He told NRK that water from the sprinkler system was being pumped out when crews arrived, with some water on the floor taken up using wet vacuums.
Haugstøyl advised businesses to map the technology and equipment they deploy, particularly what is known as operational technology — the systems governing mechanical functions such as a cooling fan. He said phasing out old equipment and applying security updates where possible are important steps, and warned that default manufacturer passwords or very simple ones must be changed.
What to watch
Whether investigators confirm the intrusion as a cyberattack, and whether the same external-connection weakness turns up at other sites, are the questions to follow.
