Supermarket freezers across Sweden, Belgium, and Luxembourg were hit by a suspected cyber-attack

A suspected cyber-attack hit supermarket freezers in Sweden, Belgium, and Luxembourg overnight, raising temperatures to dangerous levels and spoiling food across dozens of stores. It marks the second such incident in weeks. A similar attack struck hundreds of French stores last month.

Both ICA and Coop stores in Sweden were affected by the overnight incident. “We are aware that a limited number of stores were affected by an incident overnight, which impacted their refrigeration and freezer systems,” a spokesperson for ICA told Reuters in an email, noting that the affected stores were operating outside ICA’s central network. ICA said it was currently supporting the affected stores in managing the situation. Coop gave differing figures to different outlets. It told the Swedish daily Aftonbladet that six of its stores had been affected, while it told the BBC that seven out of its 800 stores were affected, adding that the situation was currently contained and under control. An ICA branch in Sjöbo, southern Sweden, posted on social media: “Our refrigerators and freezers have been hacked overnight and they have set the temperature to 50 degrees.” The store was closed earlier but has since reopened to customers. An employee at a branch on Odengatan in the capital, Stockholm, was pictured throwing away bags of spoiled food.

Belgium and Luxembourg

Around 40 Delhaize supermarkets in Belgium and Luxembourg were affected by what the chain described as a computer incident occurring overnight. Ahold Delhaize, the parent company, said an IT incident had affected fridges and freezers at dozens of its supermarkets. The chain is investigating. Ahold Delhaize had separately reported a cybersecurity incident to Dutch police last month. Carrefour, a French-owned supermarket chain, said 15 of its Belgian stores were affected and that measures were taken immediately to ensure all shops remained open. Belgium’s Le Soir newspaper reported that the impact extended beyond Delhaize, including five Spar outlets, multiple Shop & Go convenience stores attached to Q8 service stations, and a number of smaller Proxy Delhaize minimarkets. A Delhaize branch in Hoeilaart, in the Flemish Brabant province of Flanders, told Het Laatste Nieuws it had lost €100,000 worth of produce. The manager said that estimate did not account for further losses resulting from closing the shop.

Stephan Moelans, chief executive of Sabcobel, a refrigeration company, said technicians were mobilised at 1am and spent all night and morning disconnecting affected installations from the grid.

Echoes of the French attack

Last month, hackers seized control of cooling units at up to 700 supermarkets across France in a large-scale attack that led to heavy losses of chilled and frozen foods. Hackers remotely overrode settings on thousands of freezers, fridges, and chiller cabinets, pushing temperatures from as low as -27C to well over 50C. Before adjusting thermostats or extending defrost programmes by hours, the hackers disabled alarm systems. Fires broke out at several stores. The Paris prosecutor’s office has opened a formal investigation, citing damage that included “food losses and fires.” French prime minister Sébastien Lecornu instructed France’s national cybersecurity agency, ANSSI, to investigate. ANSSI subsequently confirmed that supermarkets using controllers from two other companies were also targeted. The Intermarché, Coopérative U, Carrefour, Leclerc, and Monoprix chains were among those affected. Stores discarded vast quantities of fresh meat, dairy, and frozen products, with individual store losses ranging from tens of thousands of euros to more than €130,000. Two stores in Alsace alone reported a combined loss of €270,000.

In the French attack, hackers pirated controllers mostly supplied by the Danish company Danfoss. Danfoss said it had identified security flaws last year and had “long recommended” that customers install updates. Most supermarket cold aisles are connected to the internet to allow remote maintenance and to send alerts when system failures occur.

Agencies respond

John Billow, head of Sweden’s national cybersecurity centre, confirmed on Monday to Reuters that the centre is responding to multiple incidents affecting store cooling systems across the country. Belgium’s national cyber-security agency said it was also monitoring the incident. The Ahold Delhaize spokesperson is Sarah De Meester, who said the chain had established that temperatures in the cooling systems had increased and that the incident was being investigated.

Local reports indicate that 13 SuperValu shops in Ireland were also impacted. Whether the Ireland incidents are connected to the same attack has not been confirmed.