Supermarkets in Belgium and Sweden were hit by a coordinated cyberattack on their smart commercial freezers, only weeks after a similar breach in France. Ordinary connected devices were quietly taken over and used to attack the network, and the business owners got no alert, no patch and no sign that anything was wrong.
55°C
Freezer temperatures reached in some Swedish stores
~70
Supermarkets affected in Belgium alone
0
Alerts the business owners received
10M+
Networks where Qualcomm SAM protection is proven
Who was affected
The attack targeted refrigeration systems across several European countries and reached some of the region’s best-known supermarket chains:
- Sweden: Ica and Coop branches, where some freezer temperatures spiked as high as 55°C
- Belgium: Ahold Delhaize (about 40 Delhaize stores), Carrefour (about 15 stores), Intermarché (10 locations) and 5 Spar franchise stores
- Ireland: 13 SuperValu branches, operated by parent company Musgrave
- Estonia: Selver
- Finland: K-stores (K-Group)
Freezers are just one example. Cameras, printers, payment terminals, smart TVs and building controls all sit on the same network as the business’s computers, and most of them can’t run security software, rarely get updates and never warn anyone when they are taken over.
Protection that lives in the router
DrayTek Threat Protection, powered by Qualcomm Dragonwing SAM, is built for exactly this. It runs on the DrayTek router, uses cloud-based AI, and automatically protects the IoT devices that can’t protect themselves: phishing and malicious domains are blocked, attacks from the internet are stopped at the WAN, and a compromised device can’t be used to attack the rest of the LAN.
Key security insights
Defense in depth
Limiting exposed services with firewall rules and access control lists remains a fundamental principle. Qualcomm Dragonwing SAM complements these best practices by adding extra layers of prevention, detection and containment.
Protection for port-forwarded traffic
Even when services are exposed to external connections, the traffic still passes through the router, where SAM inspects and protects it:
Unencrypted traffic
Deep Packet Inspection (DPI) blocks known vulnerability exploits and stops attackers during early reconnaissance, such as device discovery and port scanning.
Zero-day attacks
Threat intelligence, device behavior analysis and dynamic policies spot attackers probing for vulnerable devices, limiting what they can do even if an initial exploit succeeds.
Encrypted traffic
HTTPS payloads can’t be read without decryption, so SAM looks at what is visible: source IP reputation, threat intelligence, connection patterns and DNS activity.
No lateral movement between VLANs
When traffic is routed through a protected router with active controls enabled, SAM stops attackers moving from one VLAN to another, going beyond standard network segmentation.
Proven in the field
SAM has been validated on more than 10 million networks worldwide. In one example, a year of monitoring about 377,000 Android TV boxes blocked massive volumes of connection attempts, brute-force attacks and port scans. Sound security configuration combined with SAM’s added protection mitigates the risk and contains the impact.
What it means for your network
- Keep exposed services to a minimum and review port-forwarding rules.
- Put IoT devices such as freezers, cameras and printers on their own VLAN.
- Turn on Threat Protection on supported DrayTek routers, such as the Vigor2136 Series and the Vigor2928 Series, so devices that can’t protect themselves are protected at the router.
Ask ABP Technology which DrayTek router fits your project and how to enable Threat Protection.