Supermarkets in five European countries — Belgium, Luxembourg, Sweden, Ireland and Estonia — reported on Monday that their refrigeration systems had been altered overnight, in incidents authorities are treating as suspected cyberattacks. No group has claimed responsibility.
In Sweden, freezers at ICA and Coop stores were set to temperatures of up to 55C, according to Newsweek. Coop said six stores were affected, and ICA referred to "a limited number" of outlets, with settings matching the temperatures recorded in the attack on French supermarkets in October. Axfood had freezers hacked at a home-delivery distribution centre in the Gothenburg area.
Thirteen of Ireland's 223 SuperValu stores
In Ireland, SuperValu — part of the Musgrave group — said a "cyber incident" affected a specific model of refrigeration equipment at 13 of its 223 stores, and that chilled and frozen products were discarded as a precaution.
In Belgium and Luxembourg, dozens of Ahold Delhaize stores saw temperatures rise overnight, according to the Belga news agency. The chief executive of Sabcobel, which supplies the equipment, said the evaporators in the group's units had been switched to defrost mode. Five stores under the Spar banner in Belgium were also attacked, according to Colruyt Group, which runs the franchise, and Newsweek additionally cites Carrefour stores in the country. In Estonia, at least one store was affected, with settings raised to 50C, according to technology supplier Kitman Coldtech.
Control devices left exposed online
Sweden's national cybersecurity centre said it is responding to several incidents involving store refrigeration. The agency says it has found a large number of operational technology devices — the systems that run machinery rather than data — exposed on the internet, and had already urged companies to update and patch them. Ahold Delhaize reported a cybersecurity incident to Dutch police last month.
That is what links the cases: the target is not the till or the customer database but the thermostat — a cheap, connected device that is rarely updated and whose failure spoils a store's stock in a single night.
The pattern repeats October's, when hundreds of supermarkets in France had fridges and freezers pushed to as high as 50C, with food losses valued in the millions of euros and fires at some stores.
For the European Commission, the incidents show that cyberattacks can disrupt services and affect citizens' daily lives, and reinforce the need to strengthen cybersecurity across the bloc. European governments have attributed a growing number of infrastructure incidents to Moscow; Russia denies any part in sabotage or hybrid warfare.
With information from Al Jazeera and Newsweek.
