A string of cyberattacks targeting commercial refrigeration units in European supermarkets has forced stores in Belgium, Sweden, Luxembourg, Ireland, and Estonia to discard food after temperatures inside freezers were artificially spiked. Most refrigeration units are connected to the internet to allow remote maintenance and troubleshooting, highlighting the vulnerability of internet-connected systems. In connection with the French incidents, Ahold previously reported a cybersecurity incident to Dutch police last month after noticing suspicious activity within its IT infrastructure.
Impact on Supermarket Chains and Refrigeration Systems
In Belgium and Luxembourg, Ahold Delhaize and Colruyt confirmed that an IT incident affected the cooling units and freezers across dozens of locations. Roughly 40 Delhaize supermarkets, 15 Carrefour locations, and 5 Spar stores operated via franchise systems in Belgium reported problems. Additionally, 13 SuperValu stores in Ireland and supermarkets in Estonia sustained operational disruptions. Colruyt Group, which manages Spar stores in Belgium through a franchise system, stated that refrigeration systems in five of its shops were targeted, while refrigeration issues were also registered at the meat processing company De Laet en Van Haver.
According to Stefan Molans, CEO of the Belgian refrigeration company Sabcobel, which maintains Delhaize’s systems, the attackers switched the evaporators of the cooling units into a defrost mode, prompting technicians to start disconnecting affected systems from the network during the night. In Sweden, operations at ICA and Coop were similarly disrupted when refrigeration systems fell victim to unauthorized access affecting a small number of stores operating outside the central network, with ICA assisting the impacted locations. A representative for an ICA store in Sjöbo stated on social media that Хладилниците и фризерите ни бяха хакнати през нощта, като температурата е била настроена на 50 градуса. Employees were also seen discarding bags of spoiled food at an ICA location on Odengatan street in central Stockholm. Meanwhile, Coop confirmed that 6 of its 800 Swedish stores were affected, though a representative told the BBC that the situation is currently managed and under control.
Belgium and Sweden Investigate Cybersecurity Incident Locally
National cybersecurity agencies in Belgium and Sweden have stepped in to monitor and investigate the situation locally, with the Swedish National Cyber Security Centre reporting active investigations.