Cyberattacks on supermarket refrigeration systems have forced stores across Europe to discard food or remove it from sale after temperatures rose overnight. Retailers in Sweden, Belgium, Luxembourg and Ireland reported incidents on November 2, with an Estonian supermarket also affected.
At an ICA franchise in Stockholm, sales manager Engla Ingwall said all the freezers reached 50 degrees Celsius. She said the attack occurred at 2 a.m. but was discovered hours later. ICA’s central office confirmed an incident affecting refrigeration and freezing systems at a limited number of stores.
Ahold Delhaize said an IT incident affected refrigeration at dozens of stores in Belgium and Luxembourg. Carrefour reported 15 affected Belgian stores, while Colruyt said five Spar shops had their refrigeration systems attacked.
In Ireland, Musgrave said a cyber incident affected refrigeration at 13 SuperValu stores. Chilled and frozen products were removed from sale as a precaution. The company said its monitoring systems raised the alarm and staff took immediate action.
The Belgian refrigeration contractor Sabcobel said evaporators in Delhaize systems had been switched to defrost mode. Chief executive Stephan Moelans told the Belga news agency his teams were disconnecting affected units from the network.
Sweden’s national cybersecurity center is working on several grocery-store incidents. Its head, John Billow, said authorities had identified many exposed operational-technology devices in Sweden and had stressed the need to update or patch them.
In Finland, Kesko reported overnight temperature anomalies at a few smaller K-food stores. Corporate security chief Petri Käyhkö said an IT-related incident had not been ruled out. He said the equipment concerned was outside Kesko’s centralized safeguards, and that automated alerts and arriving staff had prompted an investigation.
The incidents follow October’s attacks on hundreds of French supermarkets, which police said caused food losses and fires after attackers took control of refrigeration units. Reuters could not establish who carried out the November attacks or whether they are linked to the French cases.
A separate Swedish investigation published October 12 found roughly 3,800 internet-visible IP addresses associated with industrial control systems, including supermarket refrigeration. Broadcaster SVT’s count came from Censys data collected between May and September. It described internet exposure, rather than a tally of compromised devices or all control systems installed in Sweden. Billow told the broadcaster that usernames and passwords alone were insufficient protection for exposed control systems.
Delhaize said its distribution centers were operating normally and deliveries to its stores had not been disrupted. Fresh and frozen ranges were temporarily reduced at affected shops.
Sources: Reuters, Bloomberg, SVT
–
By the Control Plane Editorial Team