Fridge hacks hit supermarkets in seven European countries

Supermarket chains in at least seven European countries said Monday that the temperatures in fridges and freezers at some of their stores soared overnight to as high as 50 C, in a hacking attack that echoed an October incident in France.

The attack hit stores run by Ahold Delhaize in Belgium and Luxembourg, Colruyt in Belgium, and Swedish grocers ICA and Coop, Reuters reported in a story carried by CBC News. Ikea said at least one of its stores in Belgium was affected. The Guardian reported that chains in Finland, Estonia, the Netherlands and Ireland also reported problems.

“Everything is destroyed,” Engla Ingwall, sales manager at an ICA franchise store in Stockholm, told Reuters. She said the attack happened at 2 a.m. but was only noticed hours later. An ICA spokesperson said a limited number of stores were affected.

Colruyt Group said five of its Spar shops in Belgium had their fridge systems attacked. Carrefour Belgium reported disruption at about 15 of its 700 shops, and a spokesperson told reporters it was a cyberattack and “there is no other reason.” Swedish chain Coop said seven of its 800 stores were affected, and Ireland’s SuperValu said refrigeration systems of a specific model in 13 of its 223 shops were hit, forcing it to remove some chilled and frozen products from sale.

Reporters who visited an Ahold Delhaize store north-east of Brussels saw empty refrigerators and freezers and a sign apologizing to customers, the Guardian reported. A company spokesperson said the range of fresh and frozen products was “temporarily somewhat limited” in affected shops, while distribution centres were operating normally.

No one has claimed responsibility for either attack. Katrien Eggers, a spokesperson for Belgium’s Centre for Cybersecurity, said it was not known who was behind the latest incident “and it may never be determined.” Reuters said it could not establish whether Monday’s attacks were linked to the French incident.

At least some of the affected refrigeration units used temperature control technology from Danish company Danfoss, which was also targeted in the French attack. Danfoss said it had been working with customers to put fixes in place. After a cybersecurity firm detailed a possible vulnerability in the company’s systems over the summer, Danfoss released a patch and urged customers to install it.

Christophe Hansen, the European Union’s agriculture commissioner, called the attacks “a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it.” He said the repeated incidents were deeply concerning.

Tom Hegel, a researcher at cybersecurity firm SentinelOne, told Reuters that attacks like these are typically tied to extortion, political motives or nation-state operations. Because no financial demands have been made in the recent cases, he said, the pattern points to sabotage. Russia has repeatedly denied involvement in sabotage or hybrid warfare operations in Europe.

In the October attack in France, hackers remotely overrode settings on fridges, freezers and chiller cabinets at chains including Intermarché, Carrefour, Leclerc and Monoprix, according to the Guardian. Stores had to discard large quantities of meat, dairy and frozen goods, and the Paris prosecutor’s office has opened a formal investigation.

Luc De Laet, owner of Belgian butchery chain De Laet & Van Haver, said he was woken at 3:30 a.m. and found his fridges turned up as high as 18 C. He estimated the incident ruined about €15,000 ($23,485 Cdn) worth of meat.

In Canada, Loblaw apologized to about two million customers last month over a data breach, and the federal government recently released its first national security strategy in 20 years. Neither is linked to the European fridge attacks.

There was no word from the companies on how many stores remained affected late Monday, or when full supplies would return.

If you find reporting like this useful, consider supporting Canada News Media, an independent Canadian newsroom with no corporate parent.

Sources: Reuters via CBC News; The Guardian.