Supermarket chains in at least three European countries reported unusual disruptions Monday after refrigerators and freezers at dozens of stores malfunctioned overnight, apparently as a result of a cyberattack.
Retail giant Ahold Delhaize initially reported an "IT incident" in which temperatures in refrigeration systems at dozens of its supermarkets in Belgium and Luxembourg suddenly rose overnight. Swedish supermarket chains ICA and Coop also reported sharp temperature increases in freezers at several of their stores.
Ahold Delhaize later confirmed that the incident was a cyberattack, while at least one ICA store in Sweden also attributed the disruption to hackers. Sweden's National Cybersecurity Center confirmed that it was involved in the investigation.
One affected ICA store reported that hackers had set the temperature of its refrigerators and freezers to 50 degrees Celsius (122 degrees Fahrenheit), mirroring a cyberattack that struck hundreds of supermarkets in France three weeks earlier.
Coop, a Swedish consumer-owned retail group, told the newspaper Aftonbladet that six of its stores had experienced similar incidents.
The reports from Belgium, Luxembourg and Sweden come after an unprecedented cyberattack on French supermarkets last month, when hackers remotely manipulated refrigeration systems, driving temperatures in freezers and cold-storage rooms to at least 50 degrees Celsius.
A notice to customers in the fresh food section of an Intermarché supermarket in Névez, western France, following a cyberattack on refrigeration systems
(Photo: Fred TANNEAU / AFP)
The attack spoiled vast quantities of fresh and frozen food, forcing retailers to discard tons of products and causing estimated losses of tens of millions of euros.
French authorities did not publicly identify those responsible for the sabotage. However, the attack came amid growing European concerns about possible Russian hybrid operations, including cyberattacks, in retaliation for European support for Ukraine. No evidence publicly linking Russia to the supermarket incidents has been established.
Hundreds of French supermarkets targeted
The attack in France occurred overnight Oct. 11-12, when unidentified hackers gained remote access to software controlling temperatures in refrigerators, freezers and cold-storage rooms used by major French supermarket chains.
The attackers changed the settings remotely, causing temperatures to rise, in many cases to 50 degrees Celsius.
(Photo: Shutterstock)
The heating was timed to occur between 11 p.m. and 4 a.m., when stores were closed and employees were generally absent.
When the first workers arrived the following morning, they discovered refrigeration units that were warm and, in some cases, extremely hot. Food stored inside had spoiled, and some equipment had partially melted.
Retailers were forced to discard enormous quantities of food that no longer met health and safety requirements. Fires also broke out in several cases.
French reports at the time said more than 400 supermarket locations had been affected. The reported figures included at least 300 Intermarché and Netto stores, nearly 100 Coopérative U outlets, approximately 80 Carrefour supermarkets, about 30 Monoprix stores and several locations belonging to the E.Leclerc group.
Tons of products were discarded as a result of the cyberattack
(Photo: Shutterstock)
The figures reflected initial reports across the different chains and were not necessarily a count of confirmed, directly affected stores. Les Mousquetaires, the retail group behind Intermarché and Netto, separately confirmed that approximately 150 of its stores had been directly affected.
The Paris prosecutor's office announced a preliminary investigation into the cyberattack.
French Prime Minister Sébastien Lecornu's office said he was personally monitoring developments and that France was coordinating its response with European partners.
Danish refrigeration systems under scrutiny
According to sources familiar with the matter, the attack in France targeted refrigeration control systems manufactured by the Danish company Danfoss.
In recent months, the company disclosed several critical security vulnerabilities affecting software packages used in its refrigeration systems.
An Intermarché supermarket in Névez, western France, affected by a cyberattack targeting refrigeration systems
(Photo: Fred TANNEAU / AFP)
On Sept. 18, Danfoss reported a vulnerability that could allow attackers to gain read-and-write access to internal system variables, as well as upload and execute unauthorized computer code.
It has not been publicly established whether that particular vulnerability was exploited in the French attack.
On the day the French cyberattack became public, Danfoss said it was "aware of incidents in France affecting a limited number of refrigeration management systems."
The company said the affected units had been operating with outdated firmware, the embedded software that controls the equipment.
Danfoss said it had long recommended that customers update supported systems to the latest firmware and replace older-generation equipment with current products.
(Photo: Shan_shan / Shutterstock.com)
The company also recently noted that hackers had breached or attempted to breach refrigeration systems at supermarkets in Russia and Israel in 2022. Those stores were using outdated versions of Danfoss refrigeration controllers.
The incidents have highlighted the security risks associated with commercial refrigeration systems that can be monitored and controlled remotely.
Although such systems allow retailers to manage temperatures and equipment more efficiently, remote connectivity can also provide attackers with a way to manipulate machinery if security weaknesses are left unaddressed.
Suspected cyberattack on US military supermarkets
The severe disruptions caused by the French attack also recalled similar incidents reported in late August at at least six U.S. military commissaries, grocery stores located on military installations where service members and other authorized shoppers buy food.
Beginning Aug. 26, several military bases across the United States reported refrigeration failures.
At Fort Huachuca in Arizona, all the freezers at the base commissary reportedly switched to defrost mode overnight, causing frozen and refrigerated food to spoil.
Other military commissaries restricted sales, with some temporarily offering only shelf-stable products.
The U.S. Defense Department confirmed at the time that it was aware of a "possible refrigeration disruption" affecting the military commissary network but declined to speculate about the cause.
Investigative units from the Army and Air Force, including the cybercrime unit of the Army Criminal Investigation Division, opened an inquiry.
Last week, Reuters reported that the Pentagon suspected the refrigeration failures at the military bases were caused by a cyberattack.
U.S. military officials told the news agency that American cyber investigators were cooperating with French law enforcement authorities in their investigation.