Supermarkets in Sweden, Belgium, Ireland, Luxembourg and Estonia have been hit by a wave of cyber incidents targeting refrigerators and freezers.
Attackers have gained remote access to refrigeration systems and altered their settings, in some cases causing temperatures to rise dramatically and forcing stores to dispose of food.
In Sweden, problems were reported at ICA and Coop stores. An ICA supermarket in Sjöbo said temperatures in its refrigerators and freezers had been set to 50 degrees Celsius.
“We can’t adjust the temperatures, we can’t change them. Hot air is blowing into the freezers. Everything is ruined,” store manager Rickard Nilsson told Swedish newspaper Aftonbladet.
At another Swedish ICA store, refrigeration settings were reportedly changed remotely. At least four ICA stores and seven Coop stores have been affected.
Belgium has seen some of the most widespread disruption. Around 40 Delhaize stores, 15 Carrefour supermarkets and several Spar and Intermarché outlets have reported problems.
According to Belgian broadcaster RTL, the attackers remotely activated defrosting functions, causing refrigerator temperatures to rise rapidly. Telegraph reports that temperatures were set as high as 70C in some Delhaize stores.
Similar incidents have been reported in Luxembourg and Ireland. In Ireland, 13 SuperValu stores were affected and fresh produce was removed from sale.
Refrigeration problems also reported in Finland
A small number of K-group grocery stores in Finland reported abnormal refrigeration temperatures overnight, Kesko security manager Petri Käyhkö told Ilta-Sanomat.
The cause is still under investigation.
According to Käyhkö, interference carried out remotely over a network has not been ruled out, but the problem was limited to only a few smaller stores. Their refrigeration equipment was not covered by Kesko’s centralised protection system.
Finland’s National Cyber Security Centre said there had so far been no confirmed successful cyberattacks against supermarket refrigeration systems in the country.
The agency had already begun identifying potentially vulnerable equipment in Finland following similar attacks in France in October and had contacted retailers where such equipment was found.
S Group and Lidl have also been investigating the situation.
Britain puts retailers on alert
Britain’s National Cyber Security Centre has meanwhile contacted retailers following the incidents elsewhere in Europe, Telegraph reports.
No British supermarkets are known to have been affected so far. However, major chains including Tesco and Sainsbury’s use refrigeration equipment similar to systems targeted elsewhere.
The British Retail Consortium said retailers were working with the cyber security authorities to make their refrigeration systems as secure as possible.
The latest incidents resemble a major series of attacks against supermarkets in France in October. Hundreds of stores were affected after attackers remotely manipulated refrigeration systems and activated extended defrost cycles. Temperatures in some units reportedly rose to between 50C and 80C, causing large quantities of food to be destroyed.
Some of the affected French systems were manufactured by Danish engineering company Danfoss. The company said many were older systems or newer equipment running outdated software and said software updates and stronger network protections were available.
At least some of the Swedish stores affected in the latest incidents also appear to use Danfoss equipment, according to Telegraph. However, no single manufacturer or technical vulnerability has yet been confirmed as the common factor behind Monday’s attacks.
The attackers and their motives remain unknown. Authorities have also not established whether the incidents across the different countries are part of one coordinated campaign.