Cyberattacks on supermarket refrigeration systems are being investigated after temperature spikes spoiled food in stores across Belgium, Luxembourg and Sweden.
Ahold Delhaize and Colruyt said an overnight IT incident caused fridges and freezers to warm in dozens of shops in Belgium and Luxembourg. Swedish chains ICA and Coop also reported problems, with some stores forced to discard food.
The incidents came less than three weeks after French retailers reported a cyberattack that sent refrigeration temperatures soaring in hundreds of outlets.
Refrigeration systems switched into defrost mode
Delhaize said it discovered the temperature increases on Monday after reporting a cybersecurity incident to Dutch police in October over suspicious activity in its infrastructure.
Stephan Moelans, chief executive of Belgian refrigeration company Sabcobel, said the affected evaporators had been switched into defrost mode. Sabcobel operates systems used by Delhaize and other supermarket chains.
“We began mobilizing technicians at 1 a.m. to get the situation under control,” Mr Moelans said. “We’ve been working all night and morning to disconnect the affected units from the network.”
He said the company had been working to protect customers’ refrigeration systems against the vulnerability, but warned that many units would need physical modifications requiring further investment.
In Sweden, ICA said a limited number of its stores had been affected, although it did not give a figure. An ICA shop in Sjobo, southern Sweden, said on Facebook that its fridges and freezers had been “hacked” and set to 50C.
ICA said it had no immediate information that its systems had been subjected to a cyberattack and was investigating what had happened and the scale of the disruption.
Coop said six of its roughly 800 Swedish stores had experienced refrigeration problems. Company spokesman Carlos Cancino said some units had stopped working entirely while others had been partly impaired, adding: “I haven’t received any information that this is a cyberattack.”
French retailers previously targeted
On 12 October, French supermarket groups E Leclerc, Intermarché and Cooperative U said their refrigeration systems had been targeted in a cyberattack. Hundreds of stores were affected, forcing them to throw away spoiled food, while some equipment overheated and caused fires.
The French attack targeted refrigeration control systems made by Danish manufacturer Danfoss. No group has claimed responsibility for any of the attacks on European grocery retailers.
Christophe Hansen, the European Union’s commissioner for food and agriculture, said after the French incident that food security required greater attention and described the exploitation of vulnerabilities in essential, networked systems as a new reality.
