Cyber attack on supermarket freezers in seven European countries; food spoiled

A major and suspicious cyber attack has targeted supermarket refrigerators and freezers across seven European countries, resulting in large-scale food spoilage. According to a BBC report, supermarkets in Belgium, Sweden, Ireland, the Netherlands, Estonia, Finland, and Luxembourg have been affected. During these attacks, freezer temperatures suddenly surged to 50 degrees Celsius, rendering fresh and frozen food items unusable.

Approximately 40 supermarkets of the Delhaize chain in Belgium and Luxembourg were impacted by this incident. Stefan Moelanse, CEO of Sabcobel, a Belgian company managing the system, told Belga News Agency that it was a cyber attack. He further added that his team worked through the night and into the morning to isolate the affected units from the network. Moelanse revealed that the attackers had set the freezers' evaporators to 'defrost mode', which caused the rise in temperature.

The Sabcobel CEO stated that following an attack in France in early October, the company had been attempting to protect customers' freezers from this vulnerability, but a software update alone is insufficient to resolve the issue; physical modifications to the freezers are required. He suggested that managing freezers through a secure internet connection is the simplest solution, and most customers have migrated to this method following the attack in France.

Other supermarket chains in Belgium have also fallen victim to this attack. According to a report by The Guardian, 15 stores of the French-owned Carrefour supermarket were affected in Belgium. Carrefour spokesperson Mich Vergauwe clarified, "This is a cyber attack, there is no other reason." Similarly, Reuters reported that the Colruyt Group, which operates Spar stores in Belgium, had its fridge systems attacked in five stores.

A Delhaize branch located in Hoeilaart, Flanders, in northern Belgium, told the news website 'Het Laatste Nieuws' that they lost goods worth €1,00,000 in this incident. The store manager added that this estimate does not include additional losses incurred from closing the shop. Additionally, the refrigeration system of an Ikea store located in the Belgian city of Mons was also attacked. An Ikea spokesperson told Reuters that they had to remove some products as a precautionary measure, leading to food wastage. They also mentioned that other locations might be affected.

In Sweden, ICA and Coop supermarkets were affected. An ICA store in Sjöbo, located in the southern part of Sweden, posted on social media that their freezers had been hacked and the temperature set to 50 degrees. Another ICA store in Stockholm stated that everything was destroyed due to a cyber attack that occurred at 2 am. An ICA spokesperson confirmed that the incident affected a small number of stores operating outside the central network.

Sweden's Coop chain told the daily newspaper 'Aftonbladet' that six of its stores were attacked, while according to a BBC report, 7 out of 800 Coop stores were affected. Jon Bilo, head of Sweden's National Cyber Security Centre, told Reuters that they are working on such incidents across the country. He noted that there are many 'exposed operational technology devices' in the country that need to be updated or patched.

In Ireland, 13 out of 223 SuperValu chain stores were affected, with an attack on the refrigeration system of a specific model. This necessitated the suspension of sales of chilled and frozen products. In Estonia, one store of the Selver chain was affected. Jaan Mutso, CEO of refrigeration supply company Kitman Coldtech, told broadcaster ERR that attackers had set the temperature to 50 degrees via computer, but large-scale damage was averted due to a response within minutes.

In the Netherlands, according to Dutch public radio NOS, approximately 17 shops, including mainly small local stores, were affected. In Finland, the Kesko supermarket chain is investigating similar issues. European Union Food and Agriculture Commissioner Christophe Hansen described the incident as extremely worrying. He stated that this is a "deliberate attempt to disrupt our food supply chain and undermine consumer confidence."

These recent events are similar to the attack that occurred in France last month. According to a report by The Guardian, cooling units of approximately 700 supermarkets in France were hijacked, causing temperatures to rise from -27 degrees to 50 degrees Celsius. This led to fire incidents and losses worth millions of euros. Individual supermarkets were reported to have suffered losses ranging from thousands of euros to €1,30,000. Chains such as Intermarché, Coopérative U, Carrefour, Leclerc, and Monoprix were affected in France.

The attack in France primarily utilized controllers supplied by the Danish company Danfoss. Danfoss stated that they had identified security vulnerabilities last year and had recommended customers install updates. France's Prime Minister Sebastien Lecornu ordered the national cyber security agency 'Ansii' to investigate. Ansii reported that supermarkets using controllers from two other companies were also targeted. The Paris Prosecutor's Office has launched a formal investigation into the matter.

Tom Haggle of cybersecurity firm SentinelOne told Reuters that while cyber attacks are generally carried out for ransom or political purposes, no financial demands have been made in this case, suggesting this is 'sabotage'. He added that the retail sector is an easy target because they possess a large network of refrigeration controllers and building management systems. According to Patrick Lempierre of Tributech, attackers will continue their attempts until the system stops working, as this method is inexpensive and causes immediate damage. He warned that even after the attack in France, thousands of controllers remained exposed on the internet.

Internationally, the UK's National Cyber Security Centre stated that they are working with international partners and industries to understand the details of this incident, although no such incident has been recorded in the UK. In the US, authorities are investigating refrigeration failures that occurred at several military bases in August and are working with French officials to see if these incidents are linked. National cyber security agencies in Belgium and Sweden have confirmed they are monitoring the situation. So far, no one has claimed responsibility for this attack.