Coordinated cyberattacks disable supermarket freezers across 10 European countries

Coordinated cyberattacks disabled supermarket freezer systems across at least 10 European countries on Monday, forcing retailers to discard spoiled food and prompting EU officials to warn of a deliberate attempt to disrupt the food supply chain.

Attackers raised temperatures in refrigeration units as high as 50C (122F), affecting more than 100 shops across the continent and leaving retailers with no option but to discard spoiled food. Some units overheated to the point of melting or catching fire. The assault followed a similar cyberattack on hundreds of French supermarkets in October that spoiled tonnes of food, caused fires, and cost millions of euros.

How the attacks worked

The attacks exploited vulnerabilities in remotely managed refrigeration control systems, many of which were past their end of life or lacked necessary software updates. Sabcobel, a Belgian company that manufactures some of the affected refrigerators, said the units’ evaporators were switched to defrost mode, causing them to warm up. The method was not new. The same defrost-mode technique was suspected in the October French supermarket attacks. Danfoss, a system provider whose systems were disrupted at a Rewe Büsken supermarket in western Germany, was named as one targeted provider. Italian Prime Minister Giorgia Meloni’s office said affected businesses were ‘mostly still equipped with obsolete security systems, with interfaces directly exposed to the internet and inadequate authentication mechanisms.’ Awais Rashid, a professor of cybersecurity at the University of Bristol, said that in line with established practices, these systems should be managed via secure networks. ‘However, this is not the case in these incidents and they are accessible on the Internet,’ he said. He noted that a remote managing party can access a web server on the controller to configure the system, including temperature changes, and that there are known vulnerabilities in several controllers.

Spread across Europe

Delhaize was among the hardest hit. Around 40 stores were affected across Belgium and Luxembourg. In Ireland, 13 SuperValu stores were hit by what owner Musgrave Group called a cyber-incident. Carrefour reported refrigeration problems at about 15 of its 700 Belgian locations, while five Colruyt and Spar shops in Belgium were also affected. In Sweden, seven of Coop’s 800 stores saw cooling systems disrupted, with problems ranging from complete shutdowns to partial operation. An IKEA site in Mons, Belgium, was also hit by a cyberattack. De Laet & Van Haver, a Belgian butchery chain, lost meat worth about 15,000 euros ($16,764) at its Hove store after fridge temperatures rose as high as 18C. Portugal’s Mosqueteiros group said seven Intermarché stores were affected through an external service provider that managed refrigeration systems. In Italy, at least four Co-op supermarkets in Sicily and one business in Tuscany were hit. Kesko stores in Finland detected irregular temperatures, corner shops in the Netherlands suffered disruption, and at least one supermarket in Estonia was attacked by hackers. Mathieu Tilman, a Delhaize supermarket manager in Belgium, said: ‘I don’t even understand how anyone could do this... How can we end up throwing away so much food? I find it truly distressing. In moments like these, you just feel like quitting your job.’

Response and investigation

Belgium’s federal prosecutors opened a criminal investigation into the attacks. Italy responded too. The government called a meeting with intelligence chiefs and said the impact was ‘currently very limited,’ adding that most of the food distribution chain had up-to-date security systems able to fend off such attacks. The UK’s National Cyber Security Centre warned British retailers to update software on fridge temperature controls. NCSC chief executive Richard Horne said the agency had ‘worked through the night’ to alert potentially affected organisations, noting that the issue extended beyond supermarkets through the whole food supply chain. Paul Chichester, director of operations at the NCSC, said the impact in the UK was minimal and the agency was working to close vulnerabilities before somebody exploits them. The British Association of Independent Meat Suppliers said some of its more than 300 members were affected as collateral, though spokesman Tony Goodger said the affected devices were empty so no produce was lost.

A widening pattern

No one has claimed responsibility. EU Commissioner Christophe Hansen described the attacks as a deliberate attempt to disrupt the food supply chain. ‘Food security is not currently at risk … the food waste and impact on businesses are real,’ Hansen said. EU Commission spokesman Thomas Regnier said the incidents showed ‘how cyber-attacks can disrupt essential services and affect citizens’ daily lives,’ adding that ‘these are not isolated incidents and of course we have to be collectively resilient and prepared for such cyber incidents.’ The NCSC, launching its annual report on Tuesday, said the country was likely to suffer an AI-powered cyberattack on critical national infrastructure within two years. The Pentagon suspected that similar freezer malfunctions at US military bases in August, including Fort Huachuca in Arizona and Naval Station Newport in Rhode Island, were the result of a hack, according to Reuters citing four officials.