Cyberattacks Defrost European Supermarket Stock, Causing Widespread Food Spoilage
Multiple European supermarket chains have been hit by cyberattacks that remotely manipulated refrigeration systems, leading to significant food spoilage and operational disruption.
A wave of cyberattacks targeting refrigeration and freezer systems has caused substantial food spoilage across numerous European supermarket chains. Retailers in Belgium, Ireland, Luxembourg, and Sweden have reported incidents where attackers remotely activated defrost modes or set temperatures to dangerously high levels, rendering fresh and frozen inventory unsalable.
In Belgium, Delhaize confirmed that around 40 of its stores were affected. A store manager described the situation as "catastrophic," forcing the disposal of all fresh and frozen products. While Delhaize stated that operational continuity was maintained and deliveries were unaffected, the range of fresh and frozen goods is temporarily limited. Similar incidents have impacted approximately 15 Carrefour stores, as well as outlets operated by Intermarché, Spar, and Shop & Go.
Swedish grocery chain ICA also reported attacks affecting a "small number of stores." One affected store, ICA Nära in Böda, stated via social media that while it remained open, it had no fresh or frozen produce available due to refrigerators and freezers being hacked and set to extreme temperatures. Coop stores in central Sweden and at least 13 SuperValue stores in Ireland have also reported similar issues, leading to the disposal of spoiled goods.
These attacks follow a similar pattern to incidents that occurred in France just last month, where multiple grocery chains, including Carrefour, Intermarché, and Monoprix, experienced widespread food spoilage due to remotely defrosted appliances. Reports from the French incidents indicated that some affected stores were running outdated firmware on Danfoss refrigeration controllers, a detail that has prompted scrutiny, though it remains unclear if the latest European attacks share the same vector.
The exact scale of the food wastage and the financial impact are still being assessed, but the operational disruption and the need to discard large quantities of perishable goods represent a significant blow to the affected retailers. The attackers' motives remain unclear, and none of the companies have publicly identified who might be behind the intrusions.
This series of attacks highlights a growing vulnerability in the operational technology (OT) systems used in critical infrastructure, such as food supply chains. The ability for threat actors to remotely manipulate physical systems like refrigeration units poses a direct threat to business continuity and public safety, extending beyond traditional IT security concerns.
As investigations continue, retailers are urged to review the security of their OT environments, ensure systems are up-to-date, and implement robust monitoring and incident response plans. The ongoing nature of these attacks suggests a potential trend that could impact other sectors reliant on similar industrial control systems.
A second wave of cyberattacks has targeted supermarket freezers across Europe, impacting retailers in Sweden, Belgium, Ireland, Estonia, the Netherlands, and Luxembourg. The attacks, which manipulated temperature controls to 50°C and caused significant stock spoilage, echo a similar incident in France last month. While no group has claimed responsibility, and the use of AI is being investigated, some affected equipment, such as older Danfoss and Copeland systems, are no longer receiving security updates, raising concerns about the long-term vulnerability of critical infrastructure.
This second wave of cyberattacks has expanded the geographical scope of the refrigeration unit disruptions, now affecting supermarkets in Belgium, Luxembourg, and Sweden, in addition to the previously reported incidents in France. The attackers continue to exploit the same vulnerability, remotely switching units to defrost mode and causing food spoilage, with security researchers noting that many affected units are end-of-life and lack available patches, necessitating physical modifications for a complete fix.