Supermarkets in several European countries have reported major losses after a cyberattack disrupted refrigeration systems and caused temperatures in cold rooms and freezers to rise sharply. Incidents have been reported in Belgium, Sweden, Luxembourg, the Netherlands, Ireland, Estonia and Finland.
Swedish retailer ICA said several of its stores were attacked overnight on Sunday. The temperature of refrigerators and cold-storage rooms was reportedly raised remotely to as much as 50 degrees, damaging large quantities of fresh and frozen products. In Belgium, more than 40 Delhaize stores, 15 Carrefour locations and five Spar outlets were also affected.
Some Belgian supermarkets used refrigerated trucks to protect food, while others had to discard products after the cold chain was interrupted. Carrefour said the impact on its Belgian operations was extremely limited: 15 of its 700 stores were affected, none of them hypermarkets, and all remained open after immediate measures were taken.
The Belgian Federal Prosecutor’s Office has opened an investigation. The attackers’ identity remains unknown, both in these incidents and in a similar series of attacks reported three weeks earlier, which affected at least 700 supermarkets in France as well as stores in the Netherlands and Belgium. Those earlier incidents caused tens of millions of euros in losses through spoiled goods and damage to equipment, with small fires reported in some cases.
The apparent method was to exploit a vulnerability in the software controlling refrigeration equipment. The attackers then increased the temperature remotely, apparently during the night. Stores that did not detect the problem in time found their products spoiled or potentially unsafe for consumption the following morning.
A manager at an ICA store in Sjöbo, southern Sweden, told Aftonbladet that alarms began appearing on his phone at around 3 a.m. When he arrived, the compressors had stopped working and the refrigerators were blowing hot air. Delhaize Luxembourg said its teams were assessing an information-security incident affecting refrigeration systems at several stores.
The incidents have also drawn attention from the United States. The Pentagon is investigating whether refrigeration failures at several US military bases this summer were the result of cyberattacks. Those failures followed a similar temperature-rise pattern, although remote intrusion was not initially considered. Investigators contacted French authorities to learn more about the refrigeration failures reported in Europe.
The perpetrators have not been identified. Experts cited in the report said stronger cybersecurity measures and more frequent software updates for refrigeration-control systems could help prevent similar incidents.
Sources: El País Sociedad.