Supermarket fridges in seven European countries hit by suspected cyberattacks

Supermarkets in seven European countries said the fridges and freezers in some of their shops overheated overnight into Monday, with temperatures reaching as high as 50C (122F). Several companies confirmed they had been hacked, according to The Guardian. Problems were reported in Sweden, Belgium, Luxembourg, Ireland, Estonia, Finland and the Netherlands.

The incidents echo an attack in France last month, when hackers took control of cooling units in as many as 700 supermarkets, pushing temperatures up to 50C and causing fires and food losses that The Guardian put at tens of millions of euros. Al Jazeera reported that no one has claimed responsibility for Monday's incidents or for the French attack.

What retailers reported

In Sweden, Coop told the daily Aftonbladet that six of its shops were hit, and ICA said a limited number of its stores were affected by an overnight incident. Axfood said freezers at a distribution centre for home grocery deliveries in the Gothenburg area were hacked, as reported by Al Jazeera.

In Belgium and Luxembourg, Ahold Delhaize said fridges and freezers in dozens of its supermarkets were hit. The company did not name a cause, but a sign in a shop north-east of Brussels blamed cyberattacks. A spokesperson, Sarah De Meester, said the range of fresh and frozen goods was temporarily limited in affected shops, while distribution centres and deliveries were working normally. Stephan Moelans, chief executive of Sabcobel, which runs Delhaize's refrigeration systems, told Le Soir that his technicians began mobilising at 1am and spent the night and morning disconnecting the affected installations. He told the Belga news agency that the units' evaporators had been switched to defrost mode.

Colruyt said five of its shops had been affected, Intermarché said 15, and Carrefour Belgium reported disruption in about 15 of its 700 shops. A Colruyt Group spokesperson said five Spar shops were also attacked.

In Ireland, SuperValu, the country's third-largest supermarket chain, said refrigeration systems of one specific model had been hit by a cyber incident in 13 of its 223 shops, and that chilled and frozen products were taken off sale. In Estonia, the refrigeration supplier Kitman Coldtech told the broadcaster ERR that attackers had reached a computer controlling the cooling system at one supermarket chain and set the temperature to 50C; its chief executive said the attack was dealt with within minutes and caused no significant damage.

In Finland, Helsingin Sanomat reported that shops of the Kesko chain were looking into similar problems, and in the Netherlands the public broadcaster NOS reported that at least 17 mostly small local shops were affected.

Why refrigeration is exposed

Tom Hegel of the cybersecurity firm SentinelOne said many cyberattacks are driven by extortion or politics, but that the absence of any financial demand here points to sabotage. Patrick Lamplmair of Tributech said the method is cheap and the damage immediate, so attackers are likely to continue, and that many refrigeration systems have known flaws that have not been fixed. He said thousands of controllers were still reachable from the internet after the French attack.

John Billow, head of Sweden's national cybersecurity centre, told Reuters that the centre is responding to multiple incidents and that Sweden has quite a lot of exposed operational technology devices that need to be updated or patched.

Official response

European Commissioner for Agriculture and Food Christophe Hansen said the repeated attacks were deeply concerning and described them as a deliberate attempt to disrupt food supplies and weaken consumers' confidence. A European Commission spokesperson stressed the need to strengthen cybersecurity across the bloc. A spokesperson for the Centre for Cybersecurity Belgium told Al Jazeera that it may never be possible to identify who is behind the attack.

Al Jazeera noted that the incidents add to concern about hybrid warfare stemming from Russia's invasion of Ukraine and the Iran-United States war.