Cyberattacks Target Supermarket Refrigeration Systems Across Europe

European supermarket fridges are under cyberattack once again, with stores across a vast swathe of the continent from Sweden to Belgium hit by a hack on Monday that turned up their temperatures, echoing an incident in France just last month. Supermarket chains Ahold Delhaize and Colruyt said an IT incident overnight hit fridges and freezers in dozens of stores in Belgium and Luxembourg, while Swedish grocers ICA and Coop reported similar temperature spikes. “There has been a cyberattack and all our freezers reached 50 degrees,” Engla Ingwall, sales manager at an ICA franchise store in Stockholm, told Reuters, adding the attack occurred at 2 am but was only noticed hours later.

A spokesperson at privately held ICA said in an emailed statement that the company was aware that a “limited number of stores were affected by an incident overnight, which impacted their refrigeration and freezer systems”.

The latest incidents follow an attack in France last month, in which police said hackers seized control of cooling units at hundreds of supermarkets, causing fires and food losses. Ahold also reported a cybersecurity incident to police last month. While no-one has claimed responsibility for either attack, the cases have put a spotlight on rising anxiety among regional authorities over hybrid attacks spreading from conflicts on European borders after Russia’s 2022 invasion of Ukraine.

Moscow has repeatedly denied involvement in any sabotage or hybrid warfare operations. Reuters was unable to establish who was behind Monday’s attacks, or if there was any link to the October ones in France. Sweden’s national cybersecurity center - which said it could not speculate on who was behind the attacks - is working on several incidents affecting grocery stores across the country, the head of the center, John Billow, said on Monday. “We have in recent weeks... identified we have quite a lot of exposed operational technology devices in Sweden that we have been clear about the necessity to update or patch,” he said.

From refrigerators and heating systems to security cameras and alarm networks, an expanding range of devices once largely mechanical can now be monitored and controlled remotely, creating new opportunities for cybercriminals. Stephan Moelans, CEO of Belgian refrigeration firm Sabcobel, which operates Delhaize’s systems, told the Belga news agency the incident was a cyberattack, with units’ evaporators switched to defrost mode. Moelans’ office declined to comment. “I’ve been awake since 2 a.m. We’ve been working all night and morning to disconnect the affected units from the network,” Moelans told Belga.

A spokesperson for Colruyt Group, which operates Spar stores in Belgium under a franchise system, said five shops had their fridge systems attacked. In Ireland, food wholesaler Musgrave said that a cyber incident had affected refrigeration systems in 13 of its SuperValu stores, forcing it to remove some chilled and frozen products from sale. “Our monitoring systems alerted us to the issue and we took immediate action,” it said in a statement. “Our investigation is ongoing.”

Tom Hegel, a researcher at cybersecurity firm SentinelOne, said that attacks were usually extortion, politically motivated or nation-state level operations, with the lack of financial demands in the recent supermarket cases pointing to sabotage.

“Retail is an easy target because retail chains run enormous estates of refrigeration controllers, building management systems, door access panels and point-of-sale gear,” he said. “Grocery margins are thin and stock perishes within hours, so any disruption hurts quickly and in public.” Privately held grocery retail group Coop told Swedish daily Aftonbladet that six of its stores had been affected by similar incidents. It did not immediately respond to a request for comment. Carrefour said 15 stores out of its 700 in Belgium were impacted.