Shop freezers in seven European countries hit by cyber-attack

Moelans further elaborated on the company’s prior efforts to bolster its defenses, referencing a preceding "French attack" in early October. This earlier incident, while perhaps less widespread, had served as a stark warning, compelling Sabcobel to initiate measures to "protect our customers’ fridges against this vulnerability." However, the CEO highlighted a critical challenge: the identified vulnerabilities within these advanced refrigeration units required not merely software updates but complex physical modifications. This indicated a deeper architectural flaw or a hardware-level exploit that could not be remedied through remote patches alone, demanding a more intensive and time-consuming remediation process.

The incident throws a spotlight on the increasingly interconnected nature of modern retail infrastructure. Most supermarkets across Europe have integrated their operational systems, including refrigeration, heating, and lighting, with the internet. This connectivity facilitates efficient remote maintenance, diagnostics, and troubleshooting, allowing technicians to monitor performance, adjust settings, and resolve issues without needing to be physically present at each location. "The simplest solution is to manage the fridges over a secure internet connection. Most of our customers switched to that after the attack in France," Moelans explained, illustrating the industry’s reliance on these digital solutions for operational efficiency and cost-effectiveness. However, this convenience inherently introduces new avenues for cyber threats, turning what was once an isolated mechanical system into a potential target for malicious actors.

The immediate and most alarming consequence of the cyber-attack was the drastic temperature escalation within the compromised freezers. Reports from various locations indicated that the temperature of freezers in several shops across Europe reportedly rose to an alarming high of 50 degrees Celsius (122 degrees Fahrenheit). Such extreme temperatures are catastrophic for perishable goods, rendering vast quantities of frozen food unsafe for consumption and leading to massive financial losses for retailers. The sheer scale and coordinated nature of the temperature manipulation suggest a highly sophisticated and deliberate assault, aimed at causing maximum disruption and economic damage.

At present, the identity of those responsible for this latest apparent attack remains elusive. Cybersecurity experts and law enforcement agencies across the affected nations are actively investigating, but no group or individual has yet claimed responsibility. The lack of immediate attribution complicates the response, making it difficult to understand the motive – whether it’s financial extortion, geopolitical sabotage, or a demonstration of capability.

Intriguingly, authorities in the United States are simultaneously investigating a series of refrigeration malfunctions that occurred at a number of American military bases in August. These incidents, which also impacted critical cold storage, have prompted collaboration between US and French officials to examine potential links. The involvement of military infrastructure in a similar type of malfunction raises serious questions about whether these are isolated incidents or part of a broader, more coordinated campaign targeting critical cold chain logistics. Such a connection, if proven, could elevate the threat from opportunistic cybercrime to state-sponsored activity or a highly organized, malicious entity.

National cybersecurity agencies across Europe swiftly engaged in monitoring and response efforts. Both Belgium and Sweden’s national cyber-security agencies confirmed they were closely monitoring the incident, coordinating with affected businesses and international partners. The UK’s National Cyber Security Centre (NCSC) issued a statement confirming it was working with international partners and industry to "fully understand details of an incident." While the NCSC noted that no incidents had been officially reported in the UK, the proactive engagement underscored the potential cross-border nature of such threats and the shared responsibility in defending critical infrastructure.

The financial repercussions for individual businesses were immediate and devastating. In Flanders, northern Belgium, a Delhaize branch in Hoeilaart reported to the news website Het Laatste Nieuws that it had incurred losses amounting to €100,000 (£83,500) worth of spoiled produce. The manager of the Hoeilaart store emphasized that this estimate did not even account for the further substantial losses that would inevitably result from the necessary closure of the shop, including lost sales, wages for idle staff, and potential long-term damage to customer trust. Such closures disrupt supply chains and inconvenience thousands of customers, creating a ripple effect through local economies.

Other major retail chains also reported being impacted. Carrefour, the French-owned supermarket giant, confirmed that the incident had affected 15 of its Belgian stores. However, the company swiftly implemented measures to mitigate the impact, ensuring that all affected shops remained open. This quick response likely involved diverting fresh stock, utilizing unaffected refrigeration units, or implementing temporary cold storage solutions, demonstrating their robust incident response protocols.

Colruyt Group, which operates Spar stores in Belgium under a franchise system, informed Reuters news agency that five of its shops had their fridge systems attacked. Similarly, Sweden’s budget furniture retailer Ikea reported that refrigeration systems at its store in the western Belgian city of Mons were compromised. A spokesman for Ikea, quoted by Reuters, expressed concern, stating, "we cannot rule out that additional locations may be affected," highlighting the evolving and potentially expanding nature of the attack.

The cyber-attack’s reach extended significantly into Sweden, where several ICA and Coop shops were hit. A spokesperson for ICA confirmed that the incident had affected a "small number of ICA stores operating outside ICA’s central network," suggesting that stores with independent or less centralized IT infrastructure might have been particularly vulnerable. "ICA is currently supporting the affected stores in managing the situation," they added, indicating internal efforts to restore operations and compensate for losses. One of the ICA branches located in Sjörbo, southern Sweden, took to social media to inform its customers, posting: "Our refrigerators and freezers have been hacked overnight and they have set the temperature to 50 degrees." The store was initially closed but managed to reopen later, underscoring the rapid, albeit challenging, recovery efforts. Seven out of the 800 Coop stores in Sweden were also affected, but the company reassured the BBC that the "situation is currently contained and under control," suggesting successful containment strategies were in place.

In neighboring Finland, refrigerator malfunctions were detected in some K-stores, part of the extensive Kesko supermarket chain. The owner of Kesko was quoted by Finland’s Helsingin Sanomat newspaper, stating that its security experts were actively investigating the root cause of the problem, indicating a potentially different vector or a slower detection time in that region.

The broad geographical scope of the attack was further confirmed with reports of affected shops in Ireland, the Netherlands, and Estonia. In Ireland, the incident impacted 13 SuperValu supermarkets. A spokesman for Musgrave Group, the owner of the chain, confirmed to The Irish Times that a "cyber incident" had indeed affected their refrigeration systems, but crucially added that the impact was limited to a "specific model" of refrigerator. This detail suggests a targeted vulnerability related to a particular vendor or hardware design, offering a potential lead for investigators.

The Netherlands experienced a more diverse impact, with a spokesperson for Danish manufacturer Danfoss, a major supplier of refrigeration and air conditioning components, telling Dutch public radio channel NOS that the freezing and cooling systems of at least 17 companies in the Netherlands were attacked overnight. This affected not only large supermarkets but also smaller, independent businesses such as butcher shops and local neighborhood stores, highlighting the vulnerability of the broader food supply chain and smaller enterprises that often lack dedicated cybersecurity teams.

Finally, an attack on a Selver supermarket in Estonia was also reported, with national broadcaster ERR indicating that there were reports of other affected companies in the country, suggesting a wider, yet perhaps less publicized, impact across the Baltic state. The pervasive nature of this cyber-attack across seven European countries underscores the growing threat to industrial control systems (ICS) and Internet of Things (IoT) devices that are now integral to critical infrastructure, from food retail to energy grids. The incident serves as a stark reminder of the urgent need for robust cybersecurity measures, comprehensive incident response plans, and greater international collaboration to defend against increasingly sophisticated and disruptive cyber threats.