Cyber-attacks disrupt refrigeration systems at shops across seven European countries

Retail refrigeration systems have been disrupted across seven European countries in a fresh wave of suspected cyber-attacks, forcing shops to discard food and, in some cases, empty chilled and frozen shelves. The affected countries are Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia and Finland. The BBC reported that about 40 Delhaize supermarkets in Belgium and Luxembourg were affected, while smaller numbers of stores in the other countries also reported problems.

Sabcobel, the Belgian company that operates systems for Delhaize, said the units’ evaporators had been switched to defrost mode. Chief executive Stephan Moelans told the Belga news agency that the incident was a cyber-attack and that staff had worked overnight to disconnect affected units from the network. The temperature at some refrigeration systems reportedly rose as high as 50C.

A Delhaize branch in Hoeilaart told Belgian news website Het Laatste Nieuws that it had lost an estimated €100,000 of produce, excluding possible losses linked to closing the shop. The impact was not uniform. The Guardian reported that Ahold Delhaize described fresh and frozen stock as temporarily limited in affected stores but said its distribution centres and deliveries were operating normally.

Carrefour Belgium said around 15 of its shops were affected, while Colruyt and Intermarché reported technical problems in five and 15 stores respectively. In Sweden, several ICA and Coop shops were affected. The BBC reported that seven of Coop’s 800 Swedish stores were hit, while ICA said a small number of stores outside its central network had been affected.

A shop in Sjöbo said its refrigeration equipment had been hacked and set to 50C. The incident also reached Finland, where malfunctions were detected in some K-stores, and the Netherlands, where Dutch public radio NOS reported that systems at at least 17 companies had been attacked. The affected Dutch businesses included butcher shops and small neighbourhood stores.

In Ireland, 13 SuperValu supermarkets were affected. Musgrave Group, which owns the chain, said the cyber incident was limited to a specific refrigerator model. In Estonia, the refrigeration supplier Kitman Coldtech said attackers had accessed a computer controlling a system at one supermarket and raised the temperature to 50C; it said the problem was addressed within minutes and there was no significant damage.

The attacks resemble an incident in France last month that affected hundreds of supermarkets and caused food losses estimated by local media at millions of euros. The Guardian reported that as many as 700 French supermarkets were affected in that earlier event, with damage estimated in the tens of millions of euros. No perpetrator has been identified in the latest incidents.

Belgium and Sweden’s cyber-security agencies said they were monitoring the situation, while the United Kingdom’s National Cyber Security Centre said it was working with international partners and industry to understand the incident. The Guardian reported that EU food and agriculture commissioner Christophe Hansen called the repeated attacks a deliberate attempt to disrupt the food supply chain, but the supplied reports do not establish who was responsible or whether all incidents were coordinated. The episode has highlighted the exposure created by remote management of refrigeration systems.

Moelans said some equipment needed physical modifications rather than software updates to address the vulnerability. Sweden’s national cybersecurity centre said many operational-technology devices remained exposed and needed updating or patching. No similar incident had been reported in the UK.