Supermarket refrigeration attacks disrupt European stores

Supermarket refrigeration attacks have affected more than 115 stores across six European countries after hackers remotely altered cooling settings. The incidents forced some retailers to discard food and call managers into stores during the early morning hours on November 2.

Attackers switched off refrigeration units or activated defrost functions, allowing temperatures to rise. However, investigators have not established whether the incidents formed part of a coordinated campaign or involved separate attacks.

Retailers report disruption across six countries

The incidents affected stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia. Alongside major supermarket chains, smaller retailers also reported refrigeration failures, including butcher shops, neighbourhood stores and chocolate shops.

In Sweden, ICA confirmed problems at at least four locations, while Coop reported seven affected stores. Meanwhile, Ahold Delhaize reported disruption at around 40 locations across Belgium and Luxembourg.

Carrefour confirmed issues at 15 Belgian stores, while approximately five Spar Colruyt locations and 15 Intermarché stores also experienced problems. In addition, the incidents affected 13 SuperValu stores in Ireland and one Selver store in Estonia.

At least 17 butcher shops and neighbourhood retailers in the Netherlands reported similar failures. An Ikea store in Mons, Belgium, also experienced problems.

Altered settings force stores to discard food

An ICA store manager said someone had changed temperature settings overnight to +50°C and prevented staff from adjusting them. Consequently, the store had to throw away frozen products.

ICA said the affected locations operated outside its central network and that it was helping them manage the disruption. Similarly, Colruyt explained that independent entrepreneurs operated the affected Spar stores using their own refrigeration systems.

Coop reported failures ranging from completely disabled refrigerators and freezers to units that only worked partially. In one case, a system started generating heat. Nevertheless, the chain said it had contained the situation.

Carrefour said the incidents affected only a few cooling units, mainly freezers, at the 15 locations. As a result, all stores remained open, and none of its Belgian hypermarkets experienced disruption.

Meanwhile, Ahold Delhaize alerted managers by text message at around 4 a.m. Some stores brought in refrigerated trucks to help preserve stock.

Supplier links incidents to earlier attacks

Refrigeration supplier Sabcobel linked the supermarket refrigeration attacks to a vulnerability that attackers allegedly exploited in France the previous month. Its director, Stephan Moelans, said technicians began disconnecting affected installations at around 1 a.m.

According to Moelans, attackers remotely activated defrost functions. He also said software updates alone would not resolve the problem because the installations required physical modifications.

The supplier recommended managing refrigeration equipment through a secure internet connection. Moelans said most of its customers had adopted that approach following the French incidents.

Those earlier attacks affected hundreds of French stores using Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB controllers. However, the precise technical cause and full scope of the latest disruption remain unclear.