Cooling systems in several major supermarkets across European countries suffered cyberattacks that disabled refrigerators and freezers, causing temperatures to rise sharply. This resulted in food spoilage and forced stores to withdraw chilled and frozen products from sale.
The attacks affected stores in Ireland, Sweden, Belgium, Luxembourg, the Netherlands, and Estonia, coming less than a month after a similar cyberattack targeted hundreds of supermarkets in France.
Supermarkets in several European countries affected
In Ireland, the SuperValu supermarket chain, the country's third-largest retailer, announced that cooling systems in 13 out of 223 stores were subjected to a cyberattack, noting that affected chilled and frozen products were withdrawn from the market.
In Sweden, the National Cyber Security Centre reported dealing with several incidents affecting stores belonging to the ICA and Coop chains, where freezer temperatures rose significantly overnight.
The attacks also extended to dozens of stores belonging to the Ahold Delhaize group in Belgium and Luxembourg. The Carrefour chain announced that 15 out of 700 stores in Belgium experienced cooling system issues, while five Spar stores operated by the Colruyt Group were affected. IKEA indicated that one of its branches in Belgium was impacted, without ruling out the problem extending to other branches.
In the Netherlands, media reports indicated that 17 stores were affected, while Estonia witnessed a similar incident in one supermarket chain, where temperatures inside cooling units reached 50 degrees Celsius.
Temperatures reaching 50 degrees Celsius and food losses
The incidents revealed the extent of damage that remote control of cooling systems can cause. In one ICA store in the Swedish capital, Stockholm, refrigerator and freezer temperatures rose to 50 degrees Celsius, according to a sales official at one of the chain's branches.
She explained that the attack occurred at 2:00 a.m. and was not discovered until 5:30 a.m., after malware had disabled the cooling units.
In Belgium, a butcher shop chain suffered damages estimated at around 15,000 euros after refrigerator temperatures rose to 18 degrees Celsius, leading to the spoilage of quantities of meat.
These developments follow a similar attack in France last month, which affected about 150 stores belonging to Les Mousquetaires group, owner of the Intermarché chain, forcing the group to dispose of all affected food products.
How did hackers manage to disable the cooling systems?
According to the CEO of a Belgian company specializing in cooling systems, the attack occurred by switching the evaporator units inside the cooling systems to defrost mode, which led to rising temperatures and the disruption of the cooling process.
Cybersecurity experts believe that the increasing reliance on internet-connected systems, which allow remote monitoring and control of refrigerators and heating systems, opens the door to new cyber risks.
A researcher at the cybersecurity firm SentinelOne pointed out that the retail sector represents a relatively easy target for attackers due to its reliance on large numbers of cooling control systems, building management systems, and point-of-sale devices. Furthermore, the rapid spoilage of food makes any disruption to these systems directly and quickly impactful.
European investigations without identifying the responsible party
The Public Prosecutor's Office in Belgium has opened a criminal investigation into the attacks targeting the stores, while the Swedish National Cyber Security Centre announced it is monitoring and investigating the incidents.
No group has claimed responsibility for the attacks so far, nor have authorities identified who is behind them. These incidents have raised European concerns about escalating cyberattacks targeting infrastructure and vital sectors, amid growing anxiety over hybrid attacks linked to international tensions and conflicts.
The European Commission emphasized the importance of strengthening cybersecurity, while European officials stressed the need for supply chains to have the ability to face and respond to cyber threats.
