Cyberattack Disrupts Supermarket Refrigeration Across Europe

Hackers have targeted refrigeration and freezer systems at more than 115 supermarkets across several European nations, causing significant product losses and operational disruption. The attack involved the remote manipulation of temperature settings, in some cases causing units to switch to defrost mode or generate heat.

The disruption has affected stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia. Major retail chains, including Ahold Delhaize, ICA, and Coop, confirmed that the incidents impacted their cooling infrastructure.

Widespread Operational Impact

Ahold Delhaize reported an IT incident affecting several dozen stores in Belgium and Luxembourg. In Sweden, Coop confirmed that seven of its stores were impacted, with one unit reportedly generating heat instead of cooling. ICA also confirmed that several stores operating outside its central network were affected.

In Belgium, multiple chains including Carrefour, Spar Colruyt, and Intermarché reported issues. Some stores were forced to discard significant amounts of frozen stock. One ICA store manager reported that temperature settings were remotely changed to +50°C (122°F) and could not be modified by staff.

In the Netherlands, at least 17 butcher shops and local stores reported similar disruptions. The scale of the incident suggests a broad targeting of internet-connected industrial cooling systems.

Technical Details and Vulnerabilities

The attack appears to mirror a similar incident that occurred in France last month. Technical details suggest that attackers targeted refrigeration controllers to remotely activate defrosting functions. Previous attacks in France specifically involved Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB controllers.

Stephan Moelans, director of refrigeration vendor Sabcobel, noted that the disruption was linked to remotely activated defrost functions. He indicated that while software updates are a component of security, many of these systems require more robust management of their internet connections to prevent unauthorized remote access.

Technicians at several impacted locations have begun disconnecting affected installations to prevent further tampering. Retailers are currently working to manage the situation and restore stable cooling across their networks.