Attackers took over refrigeration systems at supermarkets in seven European countries overnight into Monday, pushing fridge and freezer temperatures as high as 50C (122F) and forcing stores to clear chilled and frozen goods from their shelves.
Retailers in Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands and Sweden reported problems, and several confirmed they had been hacked. Nobody has claimed responsibility, and authorities have not said who may be behind it. Christophe Hansen, the EU's food and agriculture commissioner, called the repeated attacks deeply concerning.
a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it
Christophe Hansen, EU food and agriculture commissioner
The method appears to mirror a strike on French supermarkets last month. Stephan Moelans, chief executive of Sabcobel, the Belgian firm that runs Delhaize's refrigeration systems, said the units' evaporators were flipped into defrost mode, and his crews worked through the night unplugging affected equipment from the network.
Moelans said his company had been trying since the French attack to shield customers' fridges, but the flaw required physical changes to the units rather than a software update alone. He said most clients had since moved to managing their fridges over a secure internet connection.
Belgian chains take the brunt
Roughly 40 Delhaize supermarkets in Belgium and Luxembourg were affected. One Delhaize store in Hoeilaart, in Flanders, put its lost produce at €100,000, a figure its manager said did not include losses from shutting the store.
Carrefour said about 15 of its roughly 700 Belgian stores were disrupted, while Colruyt Group said five Spar shops it operates had their fridge systems attacked. Ikea said freezers at its store in Mons warmed suddenly after a cyberattack, and it expected some food waste.
In Sweden, ICA said a small number of stores operating outside its central network were hit. Its branch in Sjöbo said hackers had set its fridges and freezers to 50 degrees; the store closed and later reopened. Coop first said six stores were affected, then put the figure at seven of its 800, calling the situation contained.
In Ireland, Musgrave said a cyber incident hit refrigeration in 13 of its SuperValu stores, limited to one specific model, and that some chilled and frozen products were pulled from sale.
A Danfoss spokesperson said cooling systems at no fewer than 17 Dutch companies, including butchers and small neighborhood shops, were attacked overnight. In Estonia, refrigeration supplier Kitman Coldtech said intruders reached a computer controlling cooling at one chain and raised the temperature to 50C, though its chief executive, Jann Mutso, said the response came within minutes. Selver said one outlet was affected, and Finland's Kesko was investigating malfunctions at some of its stores.
Exposed controllers, no ransom demands
John Billow, head of Sweden's national cybersecurity center, said his agency was handling incidents across the country and had found many exposed operational technology devices in Sweden that need updating or patching.
Tom Hegel of the security firm SentinelOne said the lack of any financial demand points to sabotage rather than extortion. Patrick Lamplmair of Tributech said thousands of these controllers remained reachable online after the French attack.
A few commands to a temperature controller can destroy stock overnight and close stores.
Patrick Lamplmair, Tributech
Links to the French attack
In France, hackers had hijacked controllers mostly supplied by Danfoss, which said it identified security flaws last year and had long urged customers to install updates. The Paris prosecutor's office opened a formal investigation, and France's national cybersecurity agency later found that stores using controllers from two other companies were also targeted.
U.S. authorities are investigating refrigeration malfunctions at several American military bases in August and are working with French officials to see whether the incidents are connected. Britain's National Cyber Security Centre said it was working with international partners, and no incidents have been reported in the UK.
