European supermarkets targeted in second reported cyberattack

Unknown cybercriminals hacked the refrigeration systems of supermarkets across multiple European countries during the night of Sunday and Monday, causing temperatures in freezers and coolers to spike dramatically. Belgian federal prosecutors have opened a criminal investigation into the incident. The attacks affected retail chains in Belgium, Sweden, Ireland, Luxembourg, Estonia, and the Netherlands, forcing stores to discard large quantities of spoiled meat, dairy, and frozen goods. The disruptions began around midnight local time. In Belgium, the retail conglomerate Ahold Delhaize reported an "IT incident" impacting dozens of its Delhaize stores. According to the Belgian newspaper Le Soir, approximately 40 Delhaize branches were affected. Carrefour Belgium stated that 15 of its 700 locations experienced issues, while the Dutch chain Spar reported problems in about five stores. An Ikea store in the city of Mons also confirmed that its freezers were compromised, leading staff to remove perishable items from shelves as a precaution. In Sweden, the supermarket chains ICA and Coop reported that a limited number of their branches were targeted. The ICA Kvantum branch in Sjöbo, located south of Malmö, posted on social media that its refrigerators and freezers had been hacked and set to 50 degrees Celsius. Store manager Rickard Nilsson told the newspaper Expressen that the frozen goods had become inedible and estimated the damage at tens of thousands of euros. Another ICA location in northern Öland reported similar hacking attempts, though it remained open. In Stockholm, employees were photographed disposing of spoiled inventory. Coop spokesman Carlos Cancino told the French news agency AFP that six of the chain’s roughly 800 Swedish stores were impacted. He noted that initial information suggests an outdated connection via the 4G network made the freezers vulnerable. In Ireland, the Musgrave Group announced that 13 of its SuperValu supermarkets were affected by a cyber incident targeting specific models of refrigeration systems. As a preventive measure, all chilled and frozen products in these stores were removed from sale. In the Netherlands, the Danish refrigeration equipment manufacturer Danfoss stated that at least 17 smaller businesses suffered cyberattacks against their freezing and cooling systems. In Estonia, a market belonging to the Selver chain confirmed that attackers accessed the control computer of an older Danfoss cooling system whose software had not been updated, setting a freezer to 50 degrees. The technical provider Sabcobel, which maintains many of the affected units in Belgium, said the systems were remotely placed into defrost mode. CEO Stephan Moelans told the Belga news agency that technicians were mobilized starting at 1:00 a.m. to regain control of the situation. Sabcobel detected approximately twenty affected systems among the hundreds it manages in Belgium. Luc De Laet, owner of a butcher shop chain in Belgium, said he was woken by an employee at 3:30 a.m. upon discovering that temperatures in his Hove store had risen to 18 degrees Celsius, rendering meat worth approximately 15,000 euros inedible. This incident mirrors a larger wave of attacks that struck France in mid-October. During that earlier episode, approximately 150 stores were affected, according to some reports, while others cited figures closer to 700. The targets included major chains such as Intermarché, Coopérative U, and Carrefour. At that time, Danfoss confirmed that its products were part of the attack vector. The initial breaches exploited long-known security vulnerabilities that allowed attackers to gain full remote control over the cooling units. Danfoss released updates for newer devices in August and advised customers to disconnect older units that could no longer receive security patches. European Commissioner for Agriculture and Food Christophe Hansen described the latest attacks as a "deliberate attempt to disrupt Europe's food supplies." While stating that food security is not currently at risk, he emphasized that the resulting food waste and business impacts are real. A Commission spokesperson added that these incidents demonstrate how cyberattacks can disrupt services and affect citizens' daily lives. No group has claimed responsibility for the current wave of attacks. Authorities remain uncertain whether all the incidents across the different countries constitute a single coordinated operation. However, the similarity in method, involving remote access to connected operational technology devices, links the events to the previous month's disruptions in France. In Sweden, John Billow, head of the National Cybersecurity Center, stated that his department is investigating the breach. He noted that regulators have recently identified a significant number of exposed operational technology devices in the country, including refrigerators, heating systems, security cameras, and alarm networks. These devices, which were previously mechanical, are now often monitored and controlled remotely, creating new avenues for exploitation. Coop in Sweden indicated that it had already ordered new systems following the French incidents. In Belgium, federal prosecutors launched their inquiry without immediately characterizing the event specifically as a cyberattack, though industry leaders and government officials agree on the digital nature of the intrusion. The economic dimension of this new wave remains unclear, though individual business owners have reported substantial losses due to the destruction of inventory.