Cyberattack Disrupts Supermarket Refrigeration Systems Across Belgium, Luxembourg and Sweden, Echoing Earlier France Attack

A hacking attack on European supermarkets spread across the continent on Monday, hitting fridges and freezers from Sweden to Belgium and forcing stores to throw away food, in an incident that echoed a similar attack in France last month, according to CNBC. Seeking Alpha reported that several European grocery retailers saw refrigeration systems at their stores record unusual temperature increases overnight in Belgium, Luxembourg and Sweden.

Which retailers and how many stores were hit

The attack, which raised temperatures in refrigerator and freezer units at dozens of stores, hit supermarket groups Ahold Delhaize and Colruyt in Belgium and Luxembourg, as well as Swedish grocers ICA and Coop, CNBC reported. IKEA said one store in Belgium had been impacted and that it could not rule out disruptions at other locations.

A spokesperson for Colruyt Group, which operates Spar stores in Belgium under a franchise system, said five shops had their fridge systems attacked, CNBC reported. Carrefour, which was badly hit in last month's French attack, said 15 of its 700 stores in Belgium were affected. In Sweden, Coop said 7 of its 800 stores were affected by a cyber incident involving unauthorized tampering with its refrigeration systems, while a spokesperson for ICA said the company was aware that a limited number of stores were affected overnight, with refrigeration and freezer systems impacted, according to CNBC.

The disruption also reached Ireland, where wholesaler Musgrave said the incident affected systems in 13 of its SuperValu stores, forcing it to remove some chilled and frozen products from sale.

A second wave after the French attack

The latest incidents follow an attack in France last month in which, according to police cited by CNBC, hackers seized control of cooling units at hundreds of supermarkets, causing fires and food losses. Ahold also reported a cybersecurity incident to police last month, CNBC reported. At least some of the refrigerator units affected on Monday used temperature-control technology from Danish firm Danfoss, which was also targeted in the French attack; Danfoss said it had been working with customers to implement fixes, according to CNBC.

No claim of responsibility, and no confirmed link

No one has claimed responsibility for either the Monday attacks or the earlier French attack, and Reuters, whose reporting was carried by CNBC, said it could not establish who was behind the Monday attacks or whether they were linked to the French incidents.

Katrien Eggers, a spokesperson for Belgium's Centre for Cybersecurity, told Reuters that it is not known who is behind the attack and it may never be determined. She said she was concerned about the growing number of such incidents, in part due to artificial intelligence, adding that all IT systems are potentially vulnerable and AI can now be used to successfully exploit these weaknesses, especially by sophisticated actors.

Sabotage, not extortion, researchers suggest

Tom Hegel, a researcher at cybersecurity firm SentinelOne, told Reuters that such attacks are typically linked to extortion, political motives or nation-state operations, but that the absence of financial demands in recent cases points instead to sabotage. He described retail as an easy target because retail chains run enormous estates of refrigeration controllers, building management systems, door access panels and point-of-sale gear, and said it was hard to trace hackers targeting such systems. Hegel added that an attacker who logs into an exposed control panel leaves almost nothing behind, so that a teenager and an intelligence service would look much the same from the defender's side. This framing is an interpretation offered by Hegel rather than a confirmed finding, and no attribution of the Belgian, Luxembourg or Swedish incidents to any specific actor has been established.

The European Commission said the latest incidents highlighted how digital threats are becoming increasingly disruptive. EU agriculture commissioner Christophe Hansen called the attacks a deliberate attempt to disrupt the food supply chain and undermine consumers' confidence in it, describing the repeated occurrence of such cyberattacks as deeply concerning, according to CNBC.

The human and financial toll on the ground

At an ICA franchise store in Stockholm, sales manager Engla Ingwall told Reuters, in reporting carried by CNBC, that "everything is destroyed," adding that the attack occurred at 2 a.m. local time (0100 GMT) but was only noticed hours later and that all the store's freezers had reached 50 degrees Celsius. In Belgium, butchery chain owner Luc De Laet said he rushed to his store south of Antwerp and found the fridges turned up to as high as 18 degrees Celsius, estimating that the incident ruined about €15,000 ($16,800) worth of meat. He told Reuters it was "very scary," describing hackers as controlling the temperature-registration system remotely and programming it from a distance, and said he believed they were trying to destabilize European economies. Bottom line: the scale of the disruption is documented store by store, but no one has claimed responsibility and Reuters, whose reporting was carried by CNBC, could not establish who was behind the Monday attacks or whether they were linked to the French incidents.