European supermarket chains report cyberattack disrupting refrigeration systems

A cyberattack disrupted refrigeration and freezing equipment at multiple supermarket chains across Europe on November 2, causing temperature spikes that forced the disposal of food products. The incident affected stores in Sweden, Belgium, Luxembourg, and Ireland, with specific damage reported at locations operated by Colruyt, ICA, Coop, and Musgrave.

The attack caused the temperature of refrigerators and freezers to rise abnormally at dozens of stores. In Sweden, a manager at an ICA franchise in Stockholm reported that all frozen goods were ruined after the temperature reached 50 degrees Celsius. The incident began at 2:00 a.m. local time but was not detected for several hours. ICA confirmed that the nighttime event affected the cooling systems of a small number of its stores. In Belgium, Colruyt stated that the refrigeration systems at five of its stores were targeted.

In Ireland, the wholesaler Musgrave reported that systems at 13 of its SuperValu supermarkets experienced issues, leading to the removal of some refrigerated and frozen products from shelves. The company said it acted immediately after its monitoring systems detected the problem, and an investigation is currently underway. In Sweden, the chain Coop disclosed that seven of its 800 stores were affected, with unauthorized changes made to the refrigeration settings.

The incident shares similarities with a previous cyberattack in France last month, where hackers controlled cooling equipment at hundreds of supermarkets, causing fires and food losses. No group has claimed responsibility for either the recent European attacks or the earlier French incident. The Belgian Cybersecurity Centre stated that the attacker remains unknown and may never be identified.

Some of the affected cooling equipment used temperature control technology from the Danish company Danfoss. Danfoss stated that it has been assisting its customers with remediation measures. The European Commission noted that the recent events indicate that the damage caused by cyber threats is becoming increasingly severe. A European Commission member responsible for agriculture stated that the attacks are an intentional act to disrupt the food supply chain and undermine consumer trust.

A researcher at the cybersecurity firm SentinelOne suggested that such attacks are usually motivated by extortion, political goals, or state-level actions. Because no financial ransom was demanded in the recent attacks, the researcher characterized the incident as likely intentional sabotage. The researcher noted that retail companies are easy targets because large chains must manage many cooling controllers, building management systems, access control devices, and cash register systems. The researcher also pointed out that such attacks are difficult to trace because attackers can log into exposed control panels without leaving a significant digital footprint.