European supermarkets investigate suspected cyber-attack on cooling systems

Supermarkets in Sweden, Belgium and Luxembourg are investigating overnight rises in refrigerator and freezer temperatures, raising concerns about a possible cyber-attack. The incidents affected dozens of stores and followed an attack in France that forced retailers to throw away chilled and frozen food worth millions of euros.

Swedish retailer Coop told Aftonbladet on Monday, November 2, that six stores had experienced problems. ICA also acknowledged an overnight incident involving refrigeration and freezer equipment at a limited number of locations. Ahold Delhaize, the Dutch retailer that reported a cybersecurity incident to police in the Netherlands last month, said an IT incident had affected cooling equipment at dozens of supermarkets in Belgium and Luxembourg.

Ahold Delhaize spokesperson Sarah De Meester said the company had confirmed that temperatures had risen in its cooling systems and was investigating. Belgium’s Le Soir reported problems at five Spar stores, several Shop & Go convenience shops at Q8 service stations and smaller Proxy Delhaize outlets. Stephan Moelans, chief executive of refrigeration installation specialist Sabcobel, told the newspaper that technicians began mobilising at 1am and worked through the night and morning to disconnect affected installations from the grid.

The latest incidents came after French police disclosed in October that hackers had taken over cooling equipment at as many as 700 supermarkets. Thousands of refrigerators, freezers and chilled display cabinets had their settings changed remotely. Temperatures that had been as low as minus 27C were driven above 50C. Retailers affected included Intermarché, Coopérative U, Carrefour, Leclerc and Monoprix.

The French attack left stores discarding large amounts of fresh meat, dairy goods and frozen food. Many reported losses from tens of thousands of euros to more than €130,000, equivalent to £109,000. Two supermarkets in Alsace put their combined losses at €270,000. The incident exposed weaknesses in internet-connected equipment used to keep supermarket food cold.

Most supermarket cooling aisles have internet connections so equipment can be maintained remotely and alerts issued when systems fail. In France, attackers compromised controllers supplied mainly by Danish manufacturer Danfoss. They switched off alarms before changing thermostat settings or prolonging defrost cycles by hours. Danfoss said it had found security weaknesses last year and had repeatedly recommended that customers apply updates.

The Paris prosecutor’s office opened a formal investigation into the French attack, reporting damage that included food losses and fires. Prime Minister Sébastien Lecornu also directed France’s national cybersecurity agency, ANSSI, to investigate. The agency later confirmed that the attackers had also targeted supermarkets using controllers made by two other companies.