European Supermarkets Report More Refrigeration Cyber Incidents

Belgian refrigeration company Sabcobel, which operates Delhaize’s refrigeration systems, attributed the incident to a cyberattack. CEO Stephan Moelans told Belgian news agency Belga that evaporators in the affected units had been switched into defrost mode, according to Reuters.

Colruyt Group, which operates Spar stores in Belgium under a franchise system, said refrigeration systems at five stores had been attacked.

Carrefour also reported that 15 of its stores in Belgium were affected by a cyberattack targeting refrigeration systems.

Similar problems were reported in Sweden. ICA said a limited number of its stores were affected by an overnight incident that disrupted refrigeration and freezer systems.

An ICA Kvantum store in Sjöbo, Sweden, said on Facebook that its refrigerators and freezers had been hacked and set to 50°C, or 122°F. Separately, an ICA Baronen store in Stockholm reported that its freezers were out of service following a cyberattack, according to Reuters.

Coop told Swedish media that six of its stores experienced similar problems.

John Billow, head of Sweden’s national cybersecurity center, told Reuters that the agency was working on several incidents involving refrigeration systems at grocery stores across the country.

In Ireland, Musgrave Group said a cyber incident affected a specific model of refrigeration system at 13 SuperValu stores. Chilled and frozen products were removed from sale as a precaution, according to AP. The company later said the incident had been resolved and stores were being restocked.

In Estonia, a Selver supermarket was hit by a cyberattack in which attackers accessed a computer controlling an older Danfoss refrigeration system and changed a freezer setting to 50°C, according to Estonian Public Broadcasting. Refrigeration technology supplier Kitman Coldtech said the incident was detected quickly, and no product damage occurred.

Similar Attacks Hit France

The incidents follow cyberattacks against commercial refrigeration systems in France in October.

France’s national computer emergency response team, CERT-FR, issued an alert Oct. 12 saying it was aware of numerous compromises involving remote refrigeration controllers.

The agency identified affected equipment including Danfoss AK-SM and AK-SC series controllers, as well as Copeland XWEB and Dixell XWEB systems.

French police said hackers gained control of refrigeration equipment at hundreds of supermarkets during the October attacks, with temperatures in some systems raised as high as 50°C, according to Reuters.

The Paris prosecutor’s office opened an investigation following the attacks. Authorities have not publicly identified those responsible, and no group has claimed responsibility.

CERT-FR updated its alert Oct. 16, saying the attack campaigns were “probably still underway.” The agency’s alert identified internet exposure of refrigeration management interfaces as a security concern and included recommendations for securing affected and potentially vulnerable equipment.

Authorities have not established publicly whether Monday’s incidents and the October attacks in France were carried out by the same perpetrators or involved the same method of access.

Investigations into the latest incidents are continuing.