Cyberattacks Disrupt Supermarket Refrigeration Systems Across Five European Countries

Suspected cyberattacks have disrupted refrigeration and freezer systems in supermarkets across five European countries, raising concerns the vulnerability of critical business infrastructure to digital attacks.

The incidents, reported in Belgium, Estonia, Ireland, Luxembourg and Sweden, caused temperatures in grocery store cooling systems to rise sharply, threatening food supplies and disrupting retail operations.

Sweden’s National Cybersecurity Centre confirmed on Monday that it was responding to multiple incidents affecting supermarket cooling systems.

Its head, John Billow, told Reuters that authorities had recently identified several exposed operational technology devices in the country that needed security updates or patches.

“We have in recent weeks … identified that we have quite a lot of exposed operational technology devices in Sweden that we have been clear the necessity to update or patch,” he said.

Swedish supermarket operators ICA and Coop reported sudden overnight temperature increases in freezers at some of their stores, while retailer Axfood said freezers at a grocery distribution centre in the Gothenburg area had been hacked.

Coop said six of its stores were affected, while ICA confirmed that a limited number of outlets experienced disruptions to their refrigeration and freezer systems.

In Ireland, SuperValu, the country’s third-largest supermarket chain, said a specific model of refrigeration system had been affected by a cyber incident at 13 of its 223 stores.

Belgium also recorded attacks on refrigeration systems at dozens of Ahold Delhaize stores, with similar incidents reported at five Spar outlets operated by Colruyt Group.

The chief executive of refrigeration company Sabcobel, Stephan Moelans, said the affected units had been switched to defrost mode.

In Estonia, technology supplier Kitman Coldtech confirmed that at least one supermarket chain had been affected.

Its chief executive, Jann Mutso, said the incident was recent and that temperatures in the affected systems had been raised to 50 degrees Celsius.

The incidents bear similarities to a cyberattack that affected hundreds of supermarkets in France in October, when hackers manipulated refrigeration systems, causing temperatures to rise as high as 50 degrees Celsius.

The French attack resulted in food losses and fires at several stores.

There has been no claim of responsibility for the latest incidents or the earlier attack in France.

However, the incidents have heightened concerns the vulnerability of European infrastructure to cyber warfare, particularly amid tensions linked to Russia’s invasion of Ukraine and the conflict involving Iran and the United States.

European governments have accused Russia of involvement in a growing number of attacks targeting infrastructure, although Moscow has repeatedly denied allegations of sabotage and hybrid warfare.

A European Commission spokesperson said the incidents demonstrated how cyberattacks could disrupt essential services, affect businesses and directly impact citizens’ daily lives.

The spokesperson called for stronger cybersecurity measures across the European Union.