Suspected cyberattacks disrupt supermarket refrigeration across Europe

Stores withdraw food as refrigeration fails

Belgium was among the countries affected. Ahold Delhaize said an "IT incident" had disrupted refrigeration at several Delhaize stores on Sunday night. BBC News reported that around 40 Delhaize supermarkets across Belgium and Luxembourg were affected. Carrefour Belgium put its count at 15 of 700 outlets, while Spar reported problems at around five stores.

The losses at one Delhaize branch in Hoeilaart, in Belgium's Flanders region, reached €100,000 (£83,500) worth of produce, the store told Het Laatste Nieuws. Its manager said that estimate excluded additional losses from closing the shop.

The disruption also extended beyond supermarkets. Ikea said refrigeration systems at its store in Mons, western Belgium, were affected. A spokesman told Reuters, "we cannot rule out that additional locations may be affected."

In Ireland, Musgrave Group reported a cyber incident involving refrigeration at 13 SuperValu locations. Those stores withdrew chilled and frozen products from sale as a precaution.

Manufacturer describes defrost-mode changes

Sabcobel, the Belgian refrigeration manufacturer that operates Delhaize's systems, said the affected equipment warmed after its evaporators were switched into defrost mode. The method is believed to match the one used against hundreds of French supermarkets in October.

CEO Stephan Moelans told the Belga news agency on November 2 that Sabcobel had been "working all night and morning to disconnect the affected units from the network." Since the French attacks, the company had been trying to protect customers' refrigerators against the vulnerability, he said, but the equipment required physical modifications rather than software updates alone.

National cybersecurity agencies in Belgium and Sweden said they were monitoring the incidents. The UK's National Cyber Security Centre said it was working with international partners and industry to "fully understand details of an incident," while noting that no incidents had been reported in the UK.

Different levels of confirmation elsewhere

In Sweden, freezer temperatures rose at several ICA and Coop supermarkets. The ICA Kvantum store in Sjöbo said on Facebook that its freezers had reached 50 C and that it suspected a hack. An ICA Sverige representative told Bloomberg that an overnight incident had affected refrigeration and freezer systems at a limited number of stores, which were receiving support. The representative did not confirm a cyberattack. Coop, by contrast, confirmed a hack and said seven stores were affected.

Kesko's head of corporate security, Petri Käyhkö, said refrigeration equipment at a few smaller K-food stores in Finland had shown unusual temperatures overnight. Automated alerts and employees arriving in the morning prompted an investigation. Käyhkö did not rule out an IT-related incident, but stressed that the problem was not widespread: it involved a couple of smaller stores with equipment outside Kesko's centralized safeguards.

In the Netherlands, at least 17 companies had their freezing and cooling systems attacked overnight, a spokesperson for Danish manufacturer Danfoss told Dutch public radio channel NOS. Butcher shops and small neighborhood stores were among those affected.

Estonian public broadcaster ERR reported that a Selver supermarket had been affected, along with reports of problems at other companies in the country.

October attacks affected about 700 French supermarkets

The French attacks last month disabled refrigeration systems, forcing stores to discard spoiled food. Finance Minister Roland Lescure told Parliament that about 700 of France's 10,000 supermarkets were affected. The chains included Intermarché, Coopérative U and Carrefour. No group has publicly claimed responsibility for those attacks.

Groupement Mousquetaires reported that 300 Intermarché and Netto stores were hit. Coopérative U CEO Dominique Schelcher put his chain's count at 80 of its 2,000 stores.

Danfoss, the supplier of the refrigeration management software, said most of the affected systems were older products that no longer received software or security updates. France's CERT-FR subsequently issued an alert concerning compromises of numerous Danfoss AK-SM and AK-SC refrigeration controllers. At least some affected stores had been using outdated controller firmware.

Ahold Delhaize also suffered a cyberattack in the Netherlands last month that left stores with service outages and empty shelves for days. The company has still not explained what caused that disruption.

US military freezer failures under investigation

US authorities are investigating refrigeration malfunctions that occurred at several American military bases in August. They are working with French officials to determine whether those incidents could be linked to the European supermarket attacks.

The Pentagon said last week that it was examining food-storage freezer failures across several military facilities.