Cyberattack hits supermarket fridges and freezers across Europe

A hacking attack spread across Europe on Monday, raising temperatures in fridges and freezers at dozens of supermarkets from Sweden to Belgium and forcing stores to throw away food, Dawn and The Express Tribune reported, citing Reuters and AFP.

The attack echoed one in France three weeks earlier. No one has claimed responsibility for either.

Where it hit

• Sweden: Coop confirmed six of its roughly 800 stores were hit early on Monday. ICA said “a limited number” of stores had refrigeration problems. One ICA store in Sjobo said on Facebook its fridges and freezers had “been hacked and they set the temperature at 50 degrees” Celsius.
• Belgium and Luxembourg: Ahold Delhaize and Colruyt were affected. Colruyt said five of its Spar shops had their fridge systems attacked, and Delhaize reported four stores affected in Luxembourg. IKEA Belgium said its Mons store was hit.
• Ireland: wholesaler Musgrave said 13 of its SuperValu stores were affected, and some chilled and frozen goods were taken off sale.
• Finland and Estonia: a few Kesko-group stores in Finland saw irregular temperatures, and at least one Estonian supermarket was attacked, according to AFP.

“Everything is destroyed,” said Engla Ingwall, who manages sales at an ICA franchise store in Stockholm. The attack happened at 2am but was not noticed for hours.

The common thread

ICA said the affected stores used an external refrigeration control system from Danish manufacturer Danfoss, the same supplier targeted in France. Danfoss said earlier that most of the equipment hit in France was “legacy” product that no longer receives software or security updates, and said it was working with customers on fixes.

Coop said the six stores it lost were connected through a 4G mobile network rather than the newer 5G system, which made them “more exposed”. Belgian refrigeration group Sabcobel said it began securing its installations after the French attack, but about 10pc were still unfixed.

Who might be behind it

On October 12, French police said hackers seized control of cooling units at hundreds of supermarkets, causing fires and food losses. No one has said who is responsible for Monday’s attacks or whether they are linked, Reuters reported. Tom Hegel of SentinelOne said such attacks are usually tied to extortion, political aims or nation-state operations, and that the lack of financial demands points to sabotage.

“It is not known who is behind this attack, and it may never be determined,” said Katrien Eggers of Belgium’s Centre for Cybersecurity, who added that AI can now be used to exploit weak systems, “especially by sophisticated actors”.

The incidents add to concern among European authorities about hybrid threats to infrastructure since Russia’s 2022 invasion of Ukraine. Moscow has repeatedly denied involvement in sabotage.

The EU reacts

EU agriculture commissioner Christophe Hansen called the attacks “a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it” and said the repeated occurrences were “deeply concerning”. Finland’s national cyber centre said the spread beyond France “has been expected”.

The attacks came days after crypto exchange Binance froze assets after a $6.3bn breach, another reminder of how exposed digital systems can be.

What we know, and what we don’t

• Known: dozens of stores in several countries lost cold storage on Monday, and food was discarded.
• Known: some units use Danfoss controls, as in France.
• Unknown: who is responsible, and whether this attack and the French one are connected.
• Unknown: the total amount of food destroyed, which retailers have not disclosed.

Why it matters

Reuters noted that fridges, heating systems, security cameras and alarms that were once mostly mechanical can now be monitored and controlled remotely, which creates new openings for criminals. “An attacker who logs into an exposed control panel leaves almost nothing behind,” SentinelOne’s Hegel said. Danfoss says much of the equipment hit in France was old and no longer received security updates, and Sabcobel says it began securing its installations after the French attack, so the practical lesson for retailers is to update or replace such equipment.

This article draws on reporting by Dawn and The Express Tribune.