Brussels – Supermarket chains in at least seven European countries have reported that, overnight, the temperatures in fridges and freezers at dozens of their outlets rose sharply, raising fears of a cyberattack similar to the one in France that caused losses running into millions of euros. Retailers in Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands, and Sweden have today (2 November) experienced problems with their refrigeration systems; several companies have confirmed that they have been the victims of a cyberattack. These incidents follow an attack last month in France, during which hackers took control of the refrigeration systems in around 700 supermarkets, raising temperatures to as high as 50°C and causing fires and the loss of foodstuffs, resulting in estimated losses in the tens of millions of euros. An ever-wider range of devices, including refrigeration systems, can now be monitored and controlled remotely; this has led the authorities to fear, in particular, government-sponsored hybrid attacks, in the wake of the Russian invasion of Ukraine in 2022.
For Christophe Hansen, the European Commissioner for Agriculture and Food, there is no doubt: this is “a deliberate attempt to disrupt” the EU’s food supply. The aim, according to Hansen, is also to undermine public confidence; although “food security is not currently at risk, food waste and the impact on businesses are real problems.” For this reason, a spokesperson for the European Commission stated that the Union “will continue to work with Member States” on the issue of cyber-attacks. The EU, the spokesperson added, “has various tools at its disposal to manage such incidents,” while noting that the incident demonstrates how cyber-attacks can disrupt citizens’ daily lives.
As reported by The Guardian, the Swedish chain Coop told the newspaper Aftonbladet that six of its outlets had been affected, while ICA stated that it was “aware that a limited number of shops had been affected overnight by an incident that compromised their refrigeration and freezing systems.” An ICA store in Sjöbo, in southern Sweden, reported that its fridges and freezers had been hacked and their temperature set to 50°C. Another shop, in Stockholm, reported that its freezers had broken down “due to a cyberattack at 2 am” and that “everything was destroyed.” The head of the National Cyber Security Centre, John Billow, stated that the organisation is investigating a number of incidents in various locations across Sweden. As reported to Reuters, it has emerged that there is a “rather high number of exposed operational technology devices” in the country, which require security updates or patches.
Ikea has also confirmed that at least one of its shops in Belgium has been affected: the retailer specified that the shop in question was in Mons, which had also suffered an attack on its refrigeration control systems. As a result, the group has, as a precautionary measure, removed certain food products from its refrigeration units, thereby accepting that some of the stock will be wasted. The Dutch retail chain Ahold Delhaize, which last month reported a similar incident to the authorities in the Netherlands, has announced that fridges and freezers in dozens of its supermarkets in Belgium and Luxembourg have been affected by the problem. The company has not specified the cause, but some journalists who visited a store north-east of Brussels found the fridges and freezers empty, with a sign reading: “Due to cyber-attacks, the refrigerated shelves and freezers are empty. We sincerely apologise for the inconvenience.” A company spokesperson, Sarah De Meester, explained that the range of fresh and frozen products is “temporarily somewhat limited” in the affected shops, while pointing out that distribution centres are operating as normal and that there are no disruptions to deliveries.
The Belgian newspaper Le Soir reported that dozens of shops and supermarkets had been affected, including five Spar outlets, the “Shop & Go” convenience shops attached to Q8 petrol stations, and a number of small Proxy Delhaize convenience shops. “We began mobilising technicians at 1 am,” Stephan Moelans, managing director of Sabcobel – the company that manages Delhaize’s refrigeration systems – told the newspaper. “We spent the whole night and the morning disconnecting the affected systems.” To the news agency Belga, Moelans explained that it was a cyberattack and that the systems’ evaporators had been set to defrost mode. The Colruyt and Intermarché supermarket chains also reported technical problems affecting their refrigerators in five and 15 of their stores respectively, while Carrefour Belgium reported disruption in around 15 of its 700 shops. “This is a cyberattack; there is no other explanation,” said Mich Vergauwen, a spokesperson for Carrefour.
In Finland, the daily newspaper Helsingin Sanomat reported that shops belonging to the Kesko supermarket chain are investigating similar issues, while the Dutch public broadcaster NOS reported that the systems at at least 17 outlets, mostly small ones, had been affected. In Estonia, at a supermarket chain, the attackers gained access to a computer controlling the refrigeration system, raising the temperature to 50°C, as revealed to broadcaster ERR by the refrigeration systems supplier Kitman Coldtech. “This is a very recent incident, which occurred this morning,” said the managing director Jann Mutso, adding that the attack was dealt with within a few minutes and did not cause any significant damage. The Selver supermarket chain confirmed that one of its outlets was affected. SuperValu, Ireland’s third-largest supermarket chain, has reported that its refrigeration systems – specifically a particular model found in 13 of its 223 stores – were affected by a cyber incident, necessitating the removal of chilled and frozen products from sale.
English version by the Translation Service of Withub
