For the second time in a month, supermarket chains in at least seven European countries suffered cyberattacks on their refrigerators and freezers in dozens of their stores overnight.
Stores in Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden reported problems with their refrigeration systems on Monday, and several companies confirmed they fell victim to a cyberattack, according to a report in The Guardian.
These most recent incidents follow an attack in France last month where attackers seized control of the cooling units in as many as 700 supermarkets, raising their temperatures as high as 50C (122F) and causing fires and food losses estimated in the tens of millions of euros.
A growing range of devices, including refrigeration systems, can end up monitored and controlled remotely, leading authorities to fear government-sponsored hybrid attacks in the wake of Russia’s 2022 invasion of Ukraine.
Sweden’s Coop chain told the daily Aftonbladet six of its stores had been hit. Meanwhile, ICA said it was “aware that a limited number of stores ended up affected by an incident overnight which impacted their refrigeration and freezer systems.”
An ICA store at Sjöbo in southern Sweden said its fridges and freezers suffered cyberattacks and their temperature set at 50C. Another in Stockholm said its freezers ended up broken “due to a 2 a.m. cyberattack” and “everything destroyed.”
Exposed Devices
The head of the national cybersecurity center, John Billow, said it was working on incidents around Sweden. It had established the country had “quite a lot of exposed operational technology devices” that needed updating or patching, he said in a Reuters report.
The Dutch retailer Ahold Delhaize, which last month reported a similar incident to police in the Netherlands, said fridges and freezers in dozens of its supermarkets in Belgium and Luxembourg suffered from attacks.
It did not specify the cause, but reporters visiting a store north-east of Brussels saw refrigerators and freezers empty and a sign reading: “Due to cyberattacks, there will be no products on the refrigerated or freezer shelves. We offer our sincere apologies.”
A company spokesperson, Sarah De Meester, said the range of fresh and frozen products remained “temporarily somewhat limited” in affected stores, but that distribution centers were operating normally and there was no disruption to deliveries.
Belgium’s Le Soir newspaper reported dozens of stores and supermarkets suffered from attacks, including five Spar outlets, Shop & Go convenience stores attached to Q8 service stations and some smaller Proxy Delhaize mini-markets.
“We started mobilizing technicians at 1 a.m.,” said Stephan Moelans, the chief executive of Sabcobel, which operates Delhaize’s refrigeration systems in the Le Soir report. “We spent all night and morning disconnecting the affected installations.”
He told the Belga news agency the incident was a cyberattack and the units’ evaporators ended up switched to defrost mode.
The Colruyt and Intermarché supermarket chains also said they suffered technical problems affecting fridges in five and 15 of their stores respectively, and Carrefour Belgium reported disruption in about 15 of its 700 stores.
Freezer Temperatures Rise
“It’s a cyberattack, there is no other reason,” said Mich Vergauwen, a Carrefour spokesperson. An Ikea Belgium spokesperson likewise told Agence France-Presse a cyberattack had caused the temperature of freezers in its Mons store to rise suddenly.
Ikea said it had had to remove some food products from refrigeration units as a precaution and expected some food waste as a result.
In Finland, the Helsingin Sanomat newspaper said stores operated by the Kesko supermarket chain were investigating similar problems, while the Dutch public radio NOS reported the systems of at least 17 mainly small local stores suffered from an attack.
At one Estonian supermarket chain, attackers accessed a computer controlling the refrigeration system and turned up the temperature to 50C, the refrigeration supply company Kitman Coldtech told the ERR broadcaster.
“This is very fresh, it happened this morning,” its chief executive, Jann Mutso, said, adding they responded to the attack within minutes and there had been no significant damage. The Selver supermarket chain said one of its outlets had been affected.
Ireland’s third-largest supermarket chain, SuperValu, said refrigeration systems limited to a specific model in 13 of its 223 stores had been affected by a cyber incident, and chilled and frozen products had been removed from sale.
Cyberattacks often involve extortion or are politically motivated and are potentially carried out by state-level actors, said Tom Hegel of the cybersecurity firm SentinelOne. But the supermarket attacks, with no financial demands, point to sabotage, he said.
“Retail is an easy target because retail chains run enormous estates of refrigeration controllers, building management systems, door access panels and point-of-sale gear,” Hegel told Reuters.
Attacks Continue to Succeed
Patrick Lamplmair of the cybersecurity firm Tributech said cyberattackers would keep going “until it stops working” because the method was “cheap and the damage is immediate.” Many refrigeration systems had known and as yet unfixed flaws, he said.
“Thousands of these controllers were still reachable from the Internet after the French attack,” he said. “A few commands to a temperature controller can destroy stock overnight and close stores.”
In the French attack, the hackers pirated controllers mostly supplied by the Danish company Danfoss, which said subsequently it had identified some security flaws last year and had “long recommended” customers install updates.
The hackers remotely overrode the settings on thousands of freezers, fridges and chiller cabinets at chains including Intermarché, Coopérative U, Carrefour, Leclerc and Monoprix, pushing them from as low as -27C to well over 50C.
The stores had to discard vast quantities of fresh meat, dairy and frozen products. Individual supermarkets reportedly suffered losses ranging from tens of thousands of euros to more than €130,000 ($145,590).
The Paris prosecutor’s office has opened a formal investigation into the French attack and the prime minister, Sébastien Lecornu, instructed France’s national cybersecurity agency, Ansii, to investigate.
The agency reported supermarkets using Copeland xweb, Danfoss AK-SC series, Danfoss AK-SM series and Dixell xweb controllers ended up targeted in the attack, but authorities have not indicated who could have been behind the incidents. There have been no claims of responsibility.