Europe's Freezer Attacks and the NAS Ransomware Wave Share One Root Cause

No single chain reported more than several dozen affected stores. Belgium's Carrefour cited 15 of more than 700 stores, Intermarché 10–15, Spar under Colruyt Group 5 and one IKEA in Mons; Delhaize described "several dozen" in Belgium and Luxembourg as an IT incident. In Ireland, Musgrave pulled chilled and frozen stock from 13 of 223 SuperValu stores as a precaution. Danfoss said at least 17 Dutch businesses, including butchers and small shops, were attacked. Losses stayed modest but concrete: a butcher in Hove, south of Antwerp, had fridges raised to 18 °C and estimated roughly €15,000 of meat ruined, while a Selver store in Estonia was set to 50 °C and recovered in about ten minutes. The mechanism was mundane. In Belgium, per refrigeration contractor Sabcobel, units were switched into defrost mode, which heats cabinets instead of cooling them; elsewhere setpoints were simply raised. Danfoss told Dutch broadcaster NOS that the affected systems were not on a secure network and still used default passwords — most shops had hardened after the French attack, and the few that had not were the ones hit. ICA in Sweden and Musgrave in Ireland both stressed that the affected equipment sat outside their central networks, on supplier-managed links. Separately, Synology urged customers to update DiskStation Manager after ransomware attacks on NAS devices. The vendor said attackers exploited a flaw patched in December 2024 against outdated DSM builds, pointing to advisory SA_24_20 — which includes CVE-2024-10441 (CVSS 9.8, remote code execution in the system plugin daemon). Customers reported C3RB3R ransomware writing a .L0CK3D extension and a read-me3.txt note in each encrypted directory; Qihoo 360 also tied the family to two DSM flaws fixed in September 2026, CVE-2026-13684 and CVE-2026-13639, both rated 9.8. In the UK, BleepingComputer reported that a 3AM ransomware affiliate encrypted roughly 37 of nearly 50 machines reached from an unmanaged host in a school estate. That detail comes from its feed summary; no further technical detail was retrievable from the extracted page text.

Assume you have no endpoint telemetry on the controller and no agent on the NAS. Both attack paths surface only as network-behaviour and process-abnormality signals: an outbound session from a store VLAN to an address that is not a known contractor, or an authentication event on a management interface you never onboarded to the SIEM. Synology's own logs live on the appliance that the ransomware encrypts first, so retention has to be off-box before the fact.

Build the exposure list from CERT-FR's device families and DSM version ranges, then confirm it against your own external attack surface rather than trusting the CMDB — Synology's fixed builds start at 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7 and 6.2.4-25556-8. Baseline netflow from retail and OT segments to contractor ASNs and alert on deviations. Forward DSM authentication logs off-box and alarm on successful logins from new geographies after repeated failures. For replay, map to T1190, T1078, T1110.001 and T1486, plus ICS techniques T0836 (Modify Parameter) and T0855 (Unauthorized Command Message).

Model the setpoint change as a detection rather than an outage: in an Arsenal purple scenario, stand up an emulated Modbus controller and replay function-code 6/16 writes to holding registers from an unauthorised master, then verify your rule fires on the write and not on the temperature symptom. For the NAS path, test file-integrity monitoring against C3RB3R's behaviour — it skips 27 directories and extensions such as BAT, DLL, EXE, LNK, MOD, MSI and SYS to stay stable, so plaintext canary files with those extensions are a weak tripwire. Seed canaries that match the encrypted set instead, and prove that snapshots are immutable and reachable when the appliance itself is not. Finally, exercise containment from an unmanaged host segment, since that is where the school estate intrusion began.