Cyberattack hits supermarket fridges in several European countries

Supermarket fridges in several European countries have been hit with a cyberattack, with those behind the attack reportedly raising the temperatures to +50°C

A total of 12 countries have been affected by suspected cyberattacks on 2 November that turned fridges onto defrost settings.

Around 40 supermarkets in Belgium and Luxembourg were affected, along with a smaller number of shops in Sweden, Ireland, the Netherlands, Estonia and Finland.

Supermarkets in Belgium, Italy, Luxembourg, and Portugal reported refrigeration problems that forced some retailers to discard food after temperatures rose overnight.

Belgian federal prosecutors have opened an investigation.

"It's a cyberattack; there is no other reason," said Mich Vergauwen, a spokesman for Carrefour Belgium, which reported problems in about 15 of its 700 stores.

Sabcobel, a Belgian refrigeration company, said the units' evaporators were switched to defrost mode, causing them to warm up. Chief executive Stephan Moelans said the firm began securing its systems after the French attack, but the units needed physical modifications, not just software updates.

This follows a similar attack in France and the United States, where authorities are investigating what caused refrigeration malfunctions at a number of American military bases in August and working with French officials to examine whether the incidents could be linked.

In France, Les Mousquetaires, which owns Intermarché, said around 150 of its stores were affected by the 12 October attack and that it had to dispose of all the food.

However, it is still unclear who is behind the latest attacks.

European Commissioner for Agriculture and Food Christophe Hansen said the bloc was treating the incidents very seriously. "They are a deliberate attempt to disrupt our food supply chain and undermine consumers' confidence in it — a warning that we must take seriously," he said.

In Sweden, Coop spokesman Carlos Cancino said six of the chain's roughly 800 stores were hit. He said the affected shops used a 4G mobile network rather than the updated 5G system, which made them "more exposed" to hackers.

In Italy, at least four Coop supermarkets in Sicily and one business in Tuscany were affected, according to media reports and the national cybersecurity agency. The government planned to hold a cybersecurity meeting with intelligence services on Tuesday.

In Portugal, the Mosqueteiros group said seven Intermarché stores were affected. It said the attack "appears to have targeted an external service provider responsible for managing the refrigeration systems".

In Ireland, SuperValu said 13 of its 223 stores were hit, while Danfoss told Dutch broadcaster NOS that 17 companies in the Netherlands were affected.

These cyberattacks occur because the software that manages commercial fridges is connected to the internet, leaving its code vulnerable to hackers. Unlike desktop and mobile devices, which alert users and IT managers when updates are needed to patch newly emerging vulnerabilities, software in products such as fridges can go long periods without updates.

No incidents have been reported in the UK, where the National Cyber Security Centre said it was working with international partners and industry to understand the incident.