Supermarkets across Europe report new suspected freezer hack

Supermarkets across Europe were hit by suspected cyberattacks that resulted in sudden changes in the temperatures of their fridges and freezers on Monday, echoing a more widespread problem in France last month.

Incidents were reported in Belgium, Ireland, Sweden, Finland and Estonia, but the overall impact of the incidents appeared to be far more limited than the French cyberattacks, potentially affecting just dozens of locations.

Ahold Delhaize, Carrefour and Spar reported issues with their refrigerators and freezers in shops in Belgium. Supermarket chains in Sweden, Ireland and Finland were also affected, causing grocers to throw away food, according to spokespeople and local media reports. Ikea said that one of the company’s stores in Mons, Belgium, was affected.

A spokesperson for Danish maker of refrigeration systems Danfoss said the incidents across Europe involved its products, as was the case in France in October. There, some 700 stores were hit by cyberattacks that disabled refrigeration systems and forced shops to throw out damaged food. The Intermarche, Cooperative U and Carrefour chains were among those impacted. No group has publicly claimed responsibility for the hack.

If the latest incidents are indeed cyberattacks, the equipment may have remained vulnerable if it is using legacy software that can’t be patched.

After supermarket hacks in France, many retailers took vulnerable Danfoss refrigeration-control systems offline for repairs or replacement, cybersecurity experts say. But nearly 5,000 remained exposed online and potentially vulnerable as of last week, before the latest incidents, said Daniel dos Santos, a vice president of research at Forescout Technologies.

Some retailers may not have known their systems were exposed. Others were evaluating replacements for outdated systems that couldn’t be patched or may have decided those costs outweighed potential losses, he said.

“There are likely business needs why these systems are online and those likely haven’t changed since the attacks in France,” dos Santos said.

Forescout has identified more than 20 confirmed attacks against refrigeration systems since the start of the year, many linked to pro-Russian hacktivist groups. No group has claimed responsibility for the latest incidents, and evidence so far suggests they were unlikely to be financially motivated, dos Santos said.

“It’s very likely someone sending a message to society — we can mess up your food supply,” he said.

Dutch retailer Ahold Delhaize confirmed that an “IT incident” took place in a number of its Delhaize shops in Belgium on Sunday night, impacting the refrigeration systems. A spokesperson for Carrefour Belgium said 15 of its 700 outlets are impacted. A spokesperson for Spar, a Dutch chain, said refrigeration in around five of its stores was hit.

In Ireland, a spokesperson for Musgrave Group said a cyber incident affected refrigeration systems in 13 of its SuperValu sites. Chilled and frozen products in the affected stores were removed from sale as a precaution. The issue was resolved and all stores are operating as normal, the company said in a statement.

Several supermarkets of the ICA and Coop chains in Sweden are seeing higher temperatures in freezers. At Ica Kvantum in Sjobo, the freezers’ temperature has been raised to 50 degrees Celsius, the store said on its Facebook page, adding that it suspects a hack.

A customer looks at an empty refrigerator at a SuperValu supermarket in Dublin on Monday. | REUTERS

“We are aware that a limited number of stores were affected by an incident overnight, which impacted their refrigeration and freezer systems,” an ICA Sverige spokesperson said via email on Monday, adding that the stores are receiving support to manage the situation, without confirming a cyberattack. Coop has seven affected stores, a spokesperson said, confirming a hack. An Ikea spokesperson wrote in an email that the company is investigating the nature and scope of the incident.

In Finland, some refrigeration equipment in a few smaller K-food grocery stores “experienced temperature anomalies overnight,” according to Petri Kayhko, head of corporate security at Kesko Oyj, Finland’s second-biggest grocer.

Kesko began investigating the cause after receiving automated alerts and as staff entered the premises in the morning, he said in an emailed response to questions. An IT-related incident is not ruled out, he said. It’s not a widespread phenomenon, but only affects a couple smaller grocery stores whose equipment is not included within the scope of Kesko’s centralized safeguards, he said.

In Estonia, grocery chain Selver experienced the problem at its only store to still be using an older type of Danfoss refrigeration control system. The issue was fixed in minutes, a spokesperson told local broadcaster ERR.

Last month, a cyberattack resulted in days of service outages and empty shelves across Ahold Delhaize stores in the Netherlands. The company has still not said what caused the problem.

In the U.S., the Pentagon said last week it was examining the failure of food storage freezers across several military facilities.

Even after the attacks became public Monday, nearly 1,000 potentially vulnerable Danfoss systems remained online, said Christiaan Beek, vice president of intelligence at Rapid7. The figure underscores how difficult it is to secure critical physical systems, where outdated code and known vulnerabilities can persist for years, he said.

“These types of devices can have a huge impact on our society and our day-to-day lives,” Beek said. “That’s the big message the hackers are sending: Whatever you try, whatever you do, there are still ways to disrupt society.”

He likened the systems to “space junk” orbiting Earth.

“We have a lot of internet junk floating around — older devices that we’re not really aware of,” he said. “These are perfect examples that should serve as a wake-up call that we need to secure them.”