Hackers Knocked Out Supermarket Freezers Across Europe and Nobody Has Claimed It
A wave of attacks on retail refrigeration spread across Europe yesterday, raising temperatures in fridge and freezer units at dozens of supermarkets from Sweden to Belgium and forcing stores to throw food away.
The incidents hit Ahold Delhaize and Colruyt in Belgium and Luxembourg, ICA and Coop in Sweden, and at least one IKEA store. Carrefour said 15 of its 700 Belgian stores were affected, and Irish wholesaler Musgrave said systems at 13 of its SuperValu stores were hit, forcing chilled and frozen products off sale.
But the loss here is measured in food rather than data. At an ICA franchise store in Stockholm the attack landed at 2am and was only noticed hours later, by which time the freezers had reached 50C. "Everything is destroyed," sales manager Engla Ingwall told Reuters during a visit to the store.
Coop said 7 of its 800 Swedish stores were affected by unauthorised tampering with refrigeration systems, and Ahold described the events as an IT incident. None of the retailers reported customer data being taken.
The mechanism is the part that should worry every retailer. Refrigeration units and building management systems are now networked so they can be monitored and adjusted remotely, which means a controller that once needed a technician with a screwdriver can be reached over the internet. At least some of the units affected yesterday used temperature control technology from Danish firm Danfoss, the same supplier caught up in the French attack last month, and the company said it has been working with customers on fixes.
And this is the second wave rather than a one off. Police in France said hackers seized control of cooling units at hundreds of supermarkets last month, causing fires and food losses, and Ahold reported a separate cyber incident to Dutch police in the same period.
Nobody has claimed responsibility for either campaign, and Reuters said it could not establish who was behind yesterday's attacks or whether they were linked to France. "It is not known who is behind this attack, and it may never be determined," said Katrien Eggers, a spokesperson for Belgium's Centre for Cybersecurity, who added that she was concerned by the growing number of incidents and that AI was making systems easier to exploit.
Tom Hegel, a researcher at security firm SentinelOne, said attacks of this shape usually trace back to extortion, politics or a state operation, and that the absence of financial demands in the recent cases points instead at sabotage. "Retail is an easy target because retail chains run enormous estates of refrigeration controllers, building management systems, door access panels and point of sale gear," he said. "A teenager and an intelligence service would look much the same from the defender's side."
So the uncomfortable reading is that the barrier to entry is low and the evidence left behind is thin. An attacker who logs into an exposed control panel barely touches the store's own network, which is why the same method has now worked twice in five weeks across two countries without a clear trail.
The European Commission treated it as an attack on infrastructure rather than a retail nuisance. "They are a deliberate attempt to disrupt our food supply chain and undermine consumers' confidence in it," said agriculture commissioner Christophe Hansen. "The repeated occurrence of these cyberattacks is deeply concerning."
What is missing is a total. No one has published the full count of affected stores, no investigation has named a culprit, and the fix most likely to matter is unglamorous, which is to take refrigeration controllers off the open internet and segment them from everything else.
Refrigeration and freezer systems at supermarkets in Sweden, Belgium, Luxembourg and Ireland were attacked yesterday
Ahold Delhaize, Colruyt, ICA, Coop, Carrefour, Musgrave and IKEA all reported incidents
An ICA store in Stockholm saw freezers reach 50C and lost its entire stock
Police said a French attack last month seized cooling units at hundreds of supermarkets and caused fires
No group has claimed responsibility and investigators have not established who is behind it
Source: Reuters
