A cyberattack on refrigeration systems has disrupted stores run by multiple supermarket chains across several European countries after hackers remotely changed temperature settings on freezers and cooling systems.
In some cases, hackers shut down refrigerators or activated defrosting systems, causing temperatures to rise, resulting in significant product losses and forcing store managers to intervene early in the morning.
Refrigeration failures were identified at dozens of supermarkets, but it is unclear whether they were hit in a coordinated attack or targeted individually.
More than 115 stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia have been affected. Spokespersons for multiple chains confirmed the issues in statements for BleepingComputer.
Supermarket chains that acknowledged refrigeration issues include:
- ICA (Sweden) - At least 4 locations affected
- Coop (Sweden) - 7 locations confirmed affected
- Ahold Delhaize (Belgium and Luxembourg) - Around 40 locations affected
- Carrefour (Belgium) - 15 locations affected
- Spar Colruyt (Belgium) - 5 locations affected
- Intermarché (Belgium) - Around 15 locations affected
- SuperValu (Ireland) - 13 stores
- Selver (Estonia) - 1 store
In the Netherlands, at least 17 butcher shops and neighborhood stores have been affected.
Additional stores are dealing with the same problems in Belgium, including an Ikea superstore in Mons, grocery stores, and chocoloate shops.
Spokespersons for ICA, Ahold Delhaize, and Spar Colruyt told BleepingComputer that their companies are providing support to affected stores and working to resolve the situation.
“We can confirm that we have been informed of an incident overnight affecting a small number of ICA stores operating outside ICA’s central network,” stated ICA’s press officer.
“The incident impacted the stores’ refrigeration and freezer systems. ICA is currently supporting the affected stores in managing the situation.”
A representative of the Colruyt Group told BleepingComputer that "there is an impact on the refrigeration systems at around five Spar stores."
"These stores are operated by independent entrepreneurs who have their own refrigeration systems. We are currently doing everything we can to resolve the issue."
In a statement for BleepingComputer, Ahold Delhaize stated that refrigeration systems at several dozen stores have been impacted by an IT incident.
“We have identified an IT incident affecting the refrigeration systems in several dozen stores,” the company's communications department said, adding that the company "immediately took the necessary measures to keep our stores operational."
A spokesperson for Coop, one of the largest grocery store chains in Sweden, said that refrigeration units at a small number of stores were impacted, and in once case the system started to generate heat.
"We can confirm that a small number of stores were affected overnight into Monday - specifically 7 out of more than 800 stores," Coop told BleepingComputer.
"The situation is currently contained and under control. The issues have ranged from completely shut-down refrigerators and freezers to partially functioning units, and in one case, the system beginning to generate heat."
In Belgium, only Carrefour stores in two regions were affected, and all hypermarkets remained completely operational.
"The impact at Carrefour is very limited: currently 15 of our 700 stores are affected, both in Flanders and Wallonia," Carrefour stated.
"Not a single hypermarket is among them. All stores remain open because it only concerns a few refrigeration units, mainly freezers. Quick action was taken so that all stores can stay open."
An ICA store manager told TV4 that temperature settings had been changed overnight to +50°C (122°F) and could not be modified, forcing the store to discard frozen food.
According to RTL media publication, Ahold Delhaize warned managers by SMS around 4 a.m. about refrigeration issues, and some stores used refrigerated trucks to try to preserve stock.
The publication also identified Sabcobel as the vendor of refrigeration systems across several of the impacted locations.
According to Sabcobel's director, Stephan Moelans, the attacker leveraged the same vulnerability used in similar attacks last month in France.
Moelans said that technicians started disconnecting affected installations since 1a.m. and attributed the disruption to remotely activated defrost functions.
Although the company tried to protect customer's systems, a simple software update is not enough, as refrigerators also require physical modifications.
"The simplest solution is to manage the refrigerators via a secure internet connection. Most of our clients have adopted this solution since the attack in France," Moelans told RTL.
BleepingComputer has contacted Sabcobel to learn more about the incident and its level of involvement, but we are still waiting for a response.
Last month's refrigerator attacks in France impacted hundreds of stores using Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB refrigeration controllers that were compromised by remote attackers who set them to defrost mode.
Uncover email threats your existing defenses may miss.
Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
English (US) ·