Hackers Turned Supermarket Freezers to Defrost in Nine Countries. The Maker Says a Software Patch Will Not Fix It; the Units Need Physical Changes

A suspected cyberattack overnight into Monday disrupted refrigeration at supermarkets in at least nine European countries, switching units to defrost mode or raising temperatures and forcing retailers to discard food, according to Euronews and the BBC. Stores in Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden reported problems.

The incident came three weeks after a cyberattack disrupted French grocery stores and forced hundreds of outlets to throw away spoiled stock, Euronews reported. No group has claimed responsibility, according to AFP.

'They are a deliberate attempt to disrupt our food supply chain and undermine consumers' confidence in it — a warning that we must take seriously,' European Commissioner for Agriculture and Food Christophe Hansen said, according to Euronews.

<h3>How it worked</h3>

Sabcobel, a Belgian company that manufactures some of the affected refrigerators and operates Delhaize's systems, said the units' evaporators were switched to defrost mode, causing them to warm up, in what is believed to be the same method used in the French incident, the BBC reported.

Sabcobel CEO Stephan Moelans told the Belga news agency that it was a cyberattack and that the company had been 'working all night and morning to disconnect the affected units from the network.' The key detail for store owners: he said that since the French attack the company had been working to 'protect our customers fridges against this vulnerability,' but that the units needed physical modifications, not just software updates. 'The simplest solution is to manage the fridges over a secure internet connection. Most of our customers switched to that after the attack in France,' he said, according to the BBC.

In Sweden, a Coop spokesman said affected stores had been connected to a 4G mobile network, not an updated 5G system, which made them 'more exposed,' Euronews reported. An ICA spokesperson, Helena Johansson, said the affected ICA stores were all connected to an external refrigeration control system from Danish manufacturer Danfoss, the same supplier targeted in the Oct. 12 attack on French retailers. A Danfoss spokesperson told Dutch broadcaster NOS that systems at at least 17 companies in the Netherlands, including butcher shops and small neighborhood stores, were attacked overnight, the BBC reported.

One ICA branch in Sjöbo, southern Sweden, wrote on social media: 'Our refrigerators and freezers have been hacked overnight and they have set the temperature to 50 degrees,' according to the BBC.

<h3>Country by country</h3>

Belgium was among the hardest hit, with dozens of stores across several chains affected, and federal prosecutors opened an investigation, Euronews reported. Around 40 Delhaize supermarkets in Belgium and Luxembourg were affected, the BBC reported. Carrefour Belgium said about 15 of its 700 stores were disrupted; spokesman Mich Vergauwen said, 'It's a cyberattack, there is no other reason.' Colruyt Group said five Spar shops were hit, and Ikea said refrigeration at its store in Mons was affected. A Delhaize branch in Hoeilaart told Het Laatste Nieuws it lost 100,000 euros worth of produce.

In Ireland, 13 SuperValu stores were affected; owner Musgrave Group told The Irish Times the impact was limited to a 'specific model' of refrigerator. Seven of Coop's 800 Swedish stores were affected, the company told the BBC. In Portugal, the Mosqueteiros group confirmed incidents at seven Intermarché stores, which 'appears to have targeted an external service provider responsible for managing the refrigeration systems,' spokesman Carlos Cancino told AFP. In Italy, at least four Coop supermarkets in Sicily and one business in Tuscany were affected; 'The attack happened at 4:00 am,' Giuseppe Spadaro of the Radenza Group told ANSA. A Selver supermarket in Estonia was also hit, according to ERR.

In Finland, Kesko's head of corporate security, Petri Kayhko, said investigators had not ruled out interference via the network, and a specialist at Finland's National Cyber Security Centre would not rule out cyber interference, Euronews reported.

<h3>Beyond the affected countries</h3>

The U.K.'s National Cyber Security Centre said it was working with international partners and industry to 'fully understand details of an incident'; no incidents were reported in the U.K., the BBC said.

<h3>What is not known</h3>

Investigators have not publicly identified who carried out the attacks, how attackers reached the systems, or whether the October and November incidents were carried out by the same actor. The account of the method comes from the manufacturer and retailers, not from a published forensic report. The total value of discarded food across the nine countries has not been tallied.