Cyber-attack hits supermarket freezers in seven European countries; about 40 Delhaize stores in Belgium affected

"All this food is now useless": Piles of rubbish after shop freezers hit by cyber-attack

By James Gregory

Dozens of supermarkets across seven European countries have been hit by a cyber-attack affecting their refrigerators and freezers.

Around 40 Delhaize supermarkets in Belgium and Luxembourg were affected, while a smaller number of shops were hit in Sweden, Ireland, the Netherlands, Estonia and Finland.

Sabcobel, a Belgian company that manufactures some of the affected refrigerators, said the units' evaporators were switched to defrost mode, causing them to warm up — in what is believed to be the same method used in last month's incident that hit hundreds of French supermarkets. Millions of euros worth of food had to be thrown away in October, local media reported at the time.

Freezers have had to be emptied at several ICA grocery stores in Sweden after the cyber-attack

Manufacturer Response

Stephan Moelans, CEO of Sabcobel, which operates Delhaize's systems, told the Belga news agency on Monday that the incident was a cyber-attack and that the company had been "working all night and morning to disconnect the affected units from the network".

He said that since the French attack in early October, the company had been working to "protect our customers fridges against this vulnerability", but that the units needed physical modifications, not just software updates.

Most supermarkets across Europe are linked to the internet, allowing maintenance and troubleshooting to be done remotely.

"The simplest solution is to manage the fridges over a secure internet connection. Most of our customers switched to that after the attack in France," Moelans added.

The temperature of freezers in several shops across Europe reportedly rose to as high as 50C (122F).

Investigation Underway

It is unclear who is behind the latest apparent attack.

In the US, authorities are investigating what caused refrigeration malfunctions at a number of American military bases in August and are working with French officials to examine whether the incidents could be linked.

Both Belgium's and Sweden's national cyber-security agencies said they were monitoring the incident.

The UK's National Cyber Security Centre said it was working with international partners and industry to "fully understand details of an incident". No incidents have been reported in the UK.

Impact by Country

Belgium

In Flanders, northern Belgium, a Delhaize branch in Hoeilaart told news website Het Laatste Nieuws it had lost €100,000 (£83,500) worth of produce. The manager said the estimate did not even take into account further losses resulting from closing the shop.

Carrefour, a French-owned supermarket, said the incident had only affected 15 of its Belgian stores, adding that measures had been taken immediately to ensure all shops remained open.

A spokesperson for Colruyt Group, which operates Spar stores in Belgium under a franchise system, told Reuters that five shops had their fridge systems attacked.

Sweden's budget furniture retailer Ikea said the refrigeration systems of its store in the western Belgian city of Mons were affected, with a spokesman quoted by Reuters as saying: "We cannot rule out that additional locations may be affected."

An employee at an ICA supermarket in Sweden's capital Stockholm was pictured throwing away bags of spoiled food

Sweden

Several ICA and Coop shops were hit. A spokesperson for ICA confirmed the incident had affected a "small number of ICA stores operating outside ICA's central network", adding: "ICA is currently supporting the affected stores in managing the situation."

One ICA branch in Sjöbo, southern Sweden, wrote on social media: "Our refrigerators and freezers have been hacked overnight and they have set the temperature to 50 degrees." The store was closed earlier but has since reopened.

Seven of the 800 Coop stores in Sweden were also affected, but the company told the BBC the "situation is currently contained and under control".

Finland

Refrigerator malfunctions were detected in some K-stores. The owner of the supermarket chain Kesko was quoted by Finland's Helsingin Sanomat newspaper as saying its security experts were investigating what caused the problem.

Ireland

Thirteen SuperValu supermarkets were impacted. A spokesman for the chain's owner, Musgrave Group, confirmed to The Irish Times that a "cyber incident" affected its refrigeration systems, but added that the impact was limited to a "specific model" of refrigerator.

Netherlands

A spokesperson for Danish manufacturer Danfoss told Dutch public radio channel NOS that the freezing and cooling systems of at least 17 companies in the Netherlands were attacked overnight, affecting butchers' shops and small neighbourhood stores.

Estonia

A Selver supermarket was affected, and there are reports of other affected companies in the country, according to ERR.

Additional reporting by Shiona McCallum

Get in Touch

Have you been affected by the issues raised in this story? Contact form

Related Topics

• Belgium
• Sweden
• Supermarkets
• Cyber-attacks