Refrigeration and freezer systems at supermarkets across Europe were hacked, driving internal temperatures sharply higher in a string of incidents. The attacks came three weeks after an identical campaign hit France on Oct. 11 and 12. The European Union has called the latest episode a deliberate attempt to disrupt the food supply chain.
Refrigerators and freezers malfunctioned at stores in at least seven countries — Belgium, Luxembourg, Sweden, Ireland, Estonia, Finland and the Netherlands — between the night of Nov. 1 and the early hours of Nov. 2, according to AFP, ABC News and Al Jazeera.
Hackers remotely switched the equipment into defrost mode, pushing internal temperatures up. At some stores the temperature setting reached 50 degrees Celsius, forcing them to discard food. Neither the perpetrators nor their motive has been identified.
In Belgium, at least 40 Delhaize stores were reported to have been affected, along with four stores in Luxembourg. Delhaize described the incident only as an “IT incident.” Colruyt and Intermarché also reported refrigeration problems at some stores. Carrefour Belgium said 15 of its 700 stores were affected.
In Sweden, ICA and Coop stores reported damage. Coop confirmed six stores were hit, while ICA said only that a limited number were affected. The manager of ICA’s Sävja store told local broadcaster TV4 that hundreds of thousands of kronor worth of food had to be thrown out. In Ireland, 13 SuperValu stores were affected. The chief executive of Belgian refrigeration firm Sabcobel said evaporators had been switched into defrost mode.
Christophe Hansen, the EU commissioner for agriculture and food, said in a statement that the repeated cyberattacks were deeply concerning, calling them “a deliberate attempt to disrupt the food supply chain and undermine consumer confidence.” The characterization of the attacks as deliberate is Hansen’s assessment, and no party has been identified as responsible.
The incidents resemble the case in France last month. There, refrigeration systems at more than 350 supermarkets were attacked, leading to food being discarded and fires at some stores. Les Mousquetaires, which operates Intermarché and Netto, said more than 300 of its stores were affected.
Prosecutors in Paris have opened an investigation. An official at the French prime minister’s office said the national cybersecurity agency ANSSI had identified a vulnerability in software made by Denmark’s Danfoss. The security firm Claroty disclosed a vulnerability in Danfoss’s AK-SM 800A controller on Aug. 9.
Danfoss said many of the affected units in France were older models no longer supported or were running outdated firmware. According to Danish public broadcaster DR, Danfoss confirmed that its products, including the AK-SM800 and AK-SC355, were again involved.
Jon Billow, head of Sweden’s National Cyber Security Centre under the National Defence Radio Establishment (FRA), said security for internet-connected operational technology equipment is often weak and that the agency had warned of the risks for some time. He said the matter is serious because food supply is critical infrastructure. Swedish authorities are examining several cases, including the ICA and Coop incidents, and have not formally confirmed them as cyberattacks.
