Supermarkets in seven European countries have been hit by a cyber-attack targeting refrigeration systems, forcing stores to discard spoiled food after temperatures in some freezers reportedly rose to 50C (122F).
Around 40 Delhaize supermarkets in Belgium and Luxembourg were affected, along with a smaller number of stores in Sweden, Ireland, the Netherlands, Estonia and Finland, BBC reported.
The attack appears to have involved hackers remotely switching refrigeration units into defrost mode, causing them to warm up. Belgian manufacturer Sabcobel said the method was similar to one used in an incident that affected hundreds of French supermarkets in October.
Stephan Moelans, Sabcobel’s chief executive, confirmed to Belgian news agency Belga that the latest incident was a cyber-attack. He said the company had worked overnight to disconnect affected units from the network.
Moelans added that the company had been working to protect customers’ refrigeration systems following the earlier attack in France, but that the vulnerability required physical modifications rather than software updates alone.
Many supermarkets across Europe connect their refrigeration systems to the internet to allow remote maintenance and troubleshooting. Moelans said securing these connections had become a priority following the previous incident.
The latest attack has caused significant food losses. A Delhaize branch in Hoeilaart, northern Belgium, estimated that it had lost €100,000 (£83,500) worth of products, according to local news outlet Het Laatste Nieuws.
Carrefour said the incident affected 15 of its stores in Belgium, but that measures had been taken to keep all branches open. Colruyt Group, which operates Spar stores in Belgium through a franchise system, said five shops had experienced attacks on their refrigeration systems.
In Sweden, several ICA and Coop supermarkets were affected. ICA said the incident involved a small number of stores operating outside its central network and that it was helping them manage the situation.
A Coop spokesperson told the BBC that seven of the company’s 800 stores in Sweden had been affected, adding that the situation was contained and under control. An ICA store in Sjöbo, southern Sweden, said its refrigerators and freezers had been hacked overnight, with temperatures raised to 50C. The store has since reopened.
The attack also affected refrigeration systems at an Ikea store in the Belgian city of Mons. The retailer said it could not rule out the possibility that additional locations might be affected.
In Finland, malfunctions were detected in some K-stores, while Ireland’s Musgrave Group confirmed that a cyber incident had affected refrigeration systems at 13 SuperValu supermarkets. The company said the impact was limited to a specific refrigerator model.
In the Netherlands, at least 17 businesses, including butcher shops and small neighbourhood stores, were reportedly affected, according to Dutch public broadcaster NOS. Estonia’s Selver supermarket chain also reported an affected store.
The identity of those responsible for the latest attack remains unknown. Belgium’s and Sweden’s national cyber-security agencies said they were monitoring the situation, while the UK’s National Cyber Security Centre said it was working with international partners and industry to establish the details. No incidents have been reported in the UK.
The incident follows a similar attack on hundreds of French supermarkets in October, which reportedly resulted in millions of euros worth of food being discarded.
US authorities are also investigating refrigeration malfunctions reported at several American military bases in August, working with French officials to determine whether those incidents could be connected.