Dozens of supermarkets across seven European countries have been forced to discard millions of euros worth of food after a suspected cyber-attack compromised their refrigeration systems. The incident, which affected stores in Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia, and Finland, caused freezers to warm up and spoil perishable goods.
Delhaize and Sabcobel systems targeted
Approximately 40 Delhaize supermarkets in Belgium and Luxembourg were primarily impacted. Stephan Moelans, the chief executive of Sabcobel, the Belgian firm that manufactures and maintains the affected refrigeration units, confirmed the breach. He stated that the attackers switched the evaporators to defrost mode, causing temperatures to rise rapidly.
Moelans told the Belga news agency that the company had been working overnight to disconnect the compromised units from the network. He noted that while the firm had been working to protect customer fridges following a similar attack in France in early October, this specific vulnerability required physical modifications to the hardware rather than simple software patches.
Reports indicate that freezer temperatures in several shops rose to as high as 50 degrees Celsius (122 degrees Fahrenheit). In Flanders, northern Belgium, a Delhaize branch in Hoeilaart estimated its loss at 100,000 euros, a figure that excluded additional revenue lost from store closures.
Widespread disruption across Europe
The attack extended beyond Belgium. In Sweden, a small number of ICA grocery stores were affected. An employee at an ICA branch in Stockholm was photographed discarding bags of spoiled food. A store in Sjöbo, southern Sweden, announced on social media that its refrigerators had been hacked overnight and set to 50 degrees. The store temporarily closed but has since reopened.
ICA confirmed that the incident impacted a small number of stores operating outside its central network. Meanwhile, Coop reported that seven of its 800 Swedish stores were affected, though the company stated the situation was now contained. In Finland, some K-stores experienced malfunctions, and Kesko, the chain owner, confirmed that security experts were investigating the cause.
Other European nations also reported disruptions. In Ireland, 13 SuperValu supermarkets were impacted. Musgrave Group, the owner of SuperValu, confirmed a cyber incident affected a specific model of refrigerator. In the Netherlands, at least 17 companies, including butcher shops and small neighborhood stores, had their freezing systems attacked. A Selver supermarket in Estonia was also reported to be affected.
Carrefour, a French-owned supermarket chain, stated that only 15 of its Belgian stores were impacted and that immediate measures were taken to keep all shops open. Colruyt Group, which operates Spar stores in Belgium, reported that five of its shops had their fridge systems attacked.
Security agencies respond
National cyber-security agencies in Belgium and Sweden are monitoring the incident. The UK National Cyber Security Centre said it was working with international partners to understand the details, noting that no incidents had been reported in the UK. The attack mirrors a method used in October that hit hundreds of French supermarkets, highlighting the risks associated with internet-connected maintenance systems.
Source: BBC
