Refrigeration systems at dozens of supermarkets across seven European countries were tampered with overnight, in what appears to be a repeat of last month’s attack on French grocery stores.
Around 40 Delhaize stores in Belgium and Luxembourg were affected, along with 15 Carrefour stores and five Spar shops in Belgium, according to the BBC. Stores were also hit in Sweden, Ireland, the Netherlands, Estonia and Finland.
Stephan Moelans, CEO of Sabcobel, which operates Delhaize’s refrigeration systems, told Belgian news agency Belga that the units’ evaporators had been switched into defrost mode. He called the incident a cyberattack and said the company had been “working all night and morning to disconnect the affected units from the network.”
Freezer temperatures in some stores reportedly reached 50°C (122°F). One Delhaize store in Hoeilaart, Belgium, said it had lost €100,000 worth of produce.
In Sweden, several ICA and Coop stores were affected. Sweden’s National Cyber Security Centre (NCSC), part of the country’s FRA signals intelligence agency, is handling the incidents.
“We are in ongoing contact with those affected,” NCSC head John Billow told Swedish broadcaster SVT. He said that after the French attack, it emerged that several of the compromised units had very simple passwords and no multifactor authentication.
Fredrik Blix, a cybersecurity researcher at Stockholm University, told SVT the attackers most likely targeted refrigeration suppliers’ systems. “This is really a failure, I think. We knew this several weeks ago and should have learned from it,” he said, adding that labs and pharmaceutical fridges running similar systems should review their security immediately.
Elsewhere, 13 SuperValu supermarkets in Ireland were affected, while refrigeration manufacturer Danfoss said the cooling systems of at least 17 companies in the Netherlands were attacked.
A repeat of the French attack
The incidents mirror the October attack in which hackers switched hundreds of French supermarket freezers into defrost mode. France’s CERT-FR later warned that refrigeration controllers exposed to the internet were being targeted.
Moelans said Sabcobel had been working since the French attack to protect its customers’ fridges, but that the units needed physical modifications, not just software updates.
No group has claimed responsibility. The UK’s National Cyber Security Centre said it was working with international partners to understand the incident, though no UK stores have been affected.
