Suspected Cyberattack on Supermarket Refrigeration Hits Stores Across Europe

Stores in Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands, Portugal and Sweden were affected. It came three weeks after an October 12 cyberattack disrupted hundreds of stores at major French retailers. No one had claimed responsibility for either incident.

Christophe Hansen, the EU commissioner for agriculture and food, said the bloc was taking the incidents "very seriously." He described them as "a deliberate attempt to disrupt our food supply chain and undermine consumers' confidence in it."

How Retailers Were Hit

Belgium saw the widest disruption, with dozens of stores across several chains affected. Federal prosecutors opened an investigation but had not yet classified the incident as a cyberattack. Some retailers had no doubt. "It's a cyberattack, there is no other reason," said Mich Vergauwen, a spokesman for Carrefour Belgium, which reported problems at about 15 of its 700 stores. Ikea Belgium said its store in Mons was hit by a cyberattack that made freezer temperatures rise suddenly early on Monday. Delhaize, Colruyt and Intermarché also reported fridge problems in Belgium without calling them a cyberattack, and four Delhaize stores in Luxembourg were affected.

In Ireland, Musgrave, which owns Supervalu, said 13 of its stores were affected by a cyber incident. In Portugal, the Mosqueteiros group confirmed incidents at seven Intermarché stores. It said the attack appeared to have targeted an external service provider that manages the refrigeration systems. Sweden's Coop said six of its roughly 800 stores were hit. Its spokesman, Carlos Cancino, said the affected stores were connected to a 4G mobile network rather than the newer 5G system, which made them more exposed.

A Common Supplier

Several accounts pointed to the same equipment. Helena Johansson, a spokesperson for Swedish chain Ica, said its affected stores were all connected to an external refrigeration control system supplied by Danish manufacturer Danfoss, the same supplier targeted in the French attack. Danfoss had not responded to AFP's request for comment.

In Estonia, public broadcaster ERR reported that hackers raised refrigeration temperatures in at least one supermarket to 50C. Jann Mutso, director of refrigeration company Kitman Coldtech, told ERR that the units were older Danfoss models like those targeted in France. "The handwriting is the same," he said.

Belgian industrial refrigeration group Sabcobel told AFP it had started securing its installations after the French attack, but about 10 percent of them were still not fixed, including some in the stores hit on Monday.

Why It Matters

The incidents show how remotely managed building and equipment systems can become a way to cause physical and financial damage. In this case, attackers appear to have gone through the refrigeration control systems supplied by a vendor, not the retailers' own IT. Roni Kokkola, an information security specialist at Finland's National Cyber Security Centre, told AFP that the spread beyond France had been expected and that vulnerabilities are now being exploited "ever more actively and rapidly."

For retailers, logistics operators and anyone running connected cold-chain equipment, the attacks raise questions about how supplier systems are secured, what network connections they use, and how quickly patches are applied across large estates of older devices.