A suspected coordinated cyberattack disrupted refrigeration systems at supermarkets in Belgium, Luxembourg, Sweden, Ireland and Estonia, causing temperatures to soar and forcing retailers to discard thousands of euros worth of perishable food.
By yourNEWS Media Newsroom
Supermarkets across at least five European countries reported suspected cyberattacks on their refrigeration systems Monday, Nov. 2, after hackers apparently manipulated temperature controls in refrigerators and freezers, spoiling large quantities of food and forcing some stores to close temporarily.
The incidents affected approximately 40 Delhaize supermarkets in Belgium and Luxembourg, 15 Carrefour locations in Belgium, several ICA and Coop stores in Sweden and 13 SuperValu supermarkets in Ireland. A separate incident was also reported in Estonia, raising concerns about vulnerabilities in internet-connected refrigeration equipment used by grocery retailers.
According to a BBC News investigation, the attacks caused refrigeration temperatures to rise sharply overnight, with one Swedish supermarket reporting that its cooling equipment had been set to 50 degrees Celsius, equivalent to 122 degrees Fahrenheit.
The unusually high temperatures rendered refrigerated and frozen products unsafe for sale, forcing employees to dispose of food and assess damage to their stores.
Delhaize, one of Belgium’s largest supermarket chains and a subsidiary of Dutch retailer Ahold Delhaize, confirmed that a computer-related incident affected refrigeration systems at approximately 40 locations overnight Sunday into Monday.
The company said it took immediate steps to limit disruptions and maintain store operations, although some locations were unable to sell certain fresh and frozen products.
Belgian newspaper Het Laatste Nieuws reported that one Delhaize supermarket in Hoeilaart, in the Flemish Brabant province, estimated approximately 100,000 euros in spoiled food losses.
The store’s manager said the estimate did not include additional financial damage associated with interrupting business operations.
Other Belgian retailers also experienced refrigeration failures. Carrefour confirmed that 15 of its more than 700 stores in Belgium were affected, while five Spar supermarkets reported similar problems.
A Belgian butcher shop also reported significant losses after its refrigeration equipment malfunctioned.
The Brussels Times reported that some Belgian store managers received warnings around 4 a.m. that refrigeration temperatures were increasing unexpectedly.
Affected locations were reported in both Flanders and Wallonia, suggesting that the disruption was not limited to a single city or local network.
Carrefour said the impact on its overall operations was limited and that measures had been implemented to keep stores open.
In Sweden, the ICA grocery chain confirmed that several stores experienced refrigeration failures during the night.
An ICA supermarket in Sjöbo, southern Sweden, reported that its refrigerators and freezers had been remotely manipulated, raising their temperature settings to 50 degrees Celsius.
“Our refrigerators and freezers have been hacked overnight and they have set the temperature to 50 degrees,” the store said in a social media statement.
The business initially closed while employees assessed the damage and removed spoiled products. It subsequently reopened to customers.
At another ICA location on the island of Öland, a store manager reported finding water covering the floor and freezer temperatures reaching 55 degrees Celsius, or 131 degrees Fahrenheit.
The rising temperatures caused frozen products to thaw, creating significant food losses and additional cleanup requirements.
An ICA spokesperson said only a limited number of locations operating outside the company’s central network had been affected.
“ICA is currently supporting the affected stores in managing the situation,” the spokesperson said.
Swedish cooperative retailer Coop also confirmed refrigeration problems at several locations, with reports placing the number of affected stores at six or seven.
The company said the incidents were contained and that employees were working to restore normal operations.
According to Reuters reporting published Monday, Sweden’s national cybersecurity authorities were investigating the disruptions and examining whether attackers had exploited weaknesses in remotely accessible industrial equipment.
In Ireland, SuperValu confirmed that refrigeration equipment at 13 of its 223 supermarkets was affected by a suspected cyberattack.
The company said the problems were limited to a particular model of refrigeration system rather than its entire store network.
Affected businesses removed chilled and frozen products from sale while investigating the failures and restoring equipment.
The incidents also extended to Estonia, where refrigeration technology provider Kitman Coldtech reported that attackers accessed a computer controlling cooling equipment at a retail location.
According to an Associated Press report, the attackers increased the equipment’s temperature setting to approximately 50 degrees Celsius.
The company said technicians responded within minutes, preventing significant damage. Estonian retailer Selver confirmed that one of its locations was affected.
The attacks followed a similar incident in France during October, when refrigeration equipment at hundreds of supermarkets was reportedly manipulated remotely.
French retailers Intermarché and Coopérative U were among those affected by the earlier disruption, which caused substantial food losses and raised questions about the security of industrial refrigeration control systems.
The French incidents reportedly involved attackers exploiting weaknesses in internet-connected equipment used to manage refrigeration temperatures.
Such systems allow retailers and maintenance contractors to monitor and adjust equipment remotely, reducing the need for technicians to visit individual locations.
However, remote access can create security vulnerabilities when systems use outdated software, weak authentication or insufficient network protections.
Unlike conventional cyberattacks involving stolen customer information or encrypted computer files, interference with refrigeration equipment can cause immediate physical and financial consequences.
Supermarkets rely on carefully controlled temperatures to preserve meat, dairy products, frozen foods and other perishable merchandise.
When refrigeration systems stop operating correctly or temperatures rise beyond safe limits, products may become unsuitable for consumption even if the equipment is subsequently restored.
Retailers must then dispose of affected inventory, sanitize equipment and restock shelves, potentially incurring substantial financial losses.
The incidents illustrate the cybersecurity challenges associated with operational technology, a category encompassing computer-controlled machinery used in manufacturing, energy distribution, building management and commercial refrigeration.
As more equipment becomes connected to the internet for monitoring and maintenance, businesses face additional risks involving unauthorized access and manipulation of physical systems.
Sweden’s cybersecurity center has warned that many operational technology devices remain exposed to potential attacks because of outdated software and insufficient security updates.
Investigators have not publicly identified the individuals or organizations responsible for the latest disruptions.
Authorities also have not established whether the incidents in different countries were coordinated or resulted from separate attacks exploiting similar vulnerabilities.
No organization had claimed responsibility as of Monday.
The simultaneous problems across multiple supermarket chains nevertheless prompted renewed scrutiny of refrigeration control systems and the third-party technology providers responsible for maintaining them.
Retailers continued working to restore affected equipment, evaluate damaged merchandise and determine how unauthorized changes to refrigeration settings may have occurred.
The investigation remains focused on identifying the technical vulnerabilities involved and determining whether the latest incidents are connected to the attacks against French supermarkets in October.
Original article
Comments