A fresh cyberattack on supermarket refrigeration systems spread across several countries in Europe, pushing up temperatures in fridges and freezers at dozens of stores from Sweden to Belgium and Ireland and forcing retailers to discard large quantities of food. The incident comes only weeks after hackers took control of cooling units at hundreds of supermarkets in France, and at least some of the affected units used technology from Danish firm Danfoss, which was also targeted in that earlier attack. No group has claimed responsibility for either incident, and authorities in several countries have begun investigating, even as concerns grow over the vulnerability of connected infrastructure.
The latest attack hit supermarket groups Ahold Delhize and Colruyt in Belgium and Luxembourg, along with Swedish grocers ICA and Coop, while one IKEA store was also affected, Reuters reported. Delhaize described the problem as an "IT incident", and Sweden's national cybersecurity centre is looking into the cases.
Stores in Sweden lose entire stock
Engla Ingwall, sales manager at an ICA franchise store in Stockholm, told Reuters the attack began around 2 a.m. local time but was only noticed hours later. She said all the freezers at the store had reached 50 degrees Celsius. ICA said a limited number of its stores had been affected overnight. Coop said seven of its 800 stores had been hit by unauthorised tampering with their refrigeration systems, and named Danfoss as one of its suppliers.
Belgium and Ireland also affected
In Belgium, Carrefour said 15 of its 700 stores were affected, and IKEA said one Belgian store had been impacted, adding that it could not rule out disruption elsewhere. Colruyt, which runs Spar stores in the country under a franchise model, said five shops had their fridge systems attacked. In Ireland, wholesaler Musgrave said 13 of its SuperValu stores were affected and that it had pulled some chilled and frozen products from sale.
Luc De Laet, owner of Belgian butchery chain De Laet & Van Haver, told Reuters he was woken at 3:30 am and found his fridges set as high as 18 degrees Celsius. He estimated the loss at about €15,000 worth of meat.
What happened in France
The Belgian and Swedish incidents echo an attack on the night of October 11-12 in France. Intermarche, Netto, Cooperative U, Carrefour, Monoprix and Auchan said they had been victims of a cyberattack that targeted Danfoss equipment used to monitor and control commercial refrigeration. The hackers reportedly triggered the defrost function continuously and at high intensity, sending temperatures up to 50 degrees Celsius. Reuters reported at the time that the French attack caused fires as well as food losses.
EU calls it a warning
EU agriculture commissioner Christophe Hansen said the incidents were a deliberate attempt to disrupt the food supply chain and undermine consumer confidence in it, calling it a warning that must be taken seriously. Danfoss said it has been working with customers to implement fixes.
