Supermarket Fridges and Freezers Overheat in Six European Countries in Suspected Second Cyberattack Wave

Since attackers took over cooling systems at up to 700 French supermarkets in mid-October, the question was whether it would happen again. It did, overnight Sunday into Monday, Nov. 2, across six countries.

What was hit

Around 40 Delhaize stores in Belgium and Luxembourg were affected. Delhaize spokesperson Sarah De Meester described an "IT incident" that raised temperatures in the cooling systems and said the incident is under investigation. She said distribution centers are running normally and deliveries to stores have not been disrupted.

Carrefour Belgium said 15 of its more than 700 Belgian stores were affected. Spokesman Mich Vergauwen said: "It's a cyberattack, there is no other reason," and described the impact as very limited. Colruyt Group said about five Spar stores it franchises had fridge systems attacked.

In Sweden, ICA said a small number of stores operating outside its central network were affected. Coop told the BBC that seven of its 800 stores were hit and the situation is contained. Swedish news agency TT reported the figure as six. Axfood said freezers at a home-delivery distribution center near Gothenburg were hacked.

In Ireland, Musgrave, which owns SuperValu, said a specific model of refrigeration system was hit by a "cyber incident" at 13 of its 223 stores. In Estonia, one Selver outlet was affected. Kitman Coldtech CEO Jann Mutso said the response came within minutes and there was no significant damage.

In the Netherlands, a Danfoss spokesperson said cooling systems at at least 17 companies were attacked overnight. The companies were not named.

Delhaize also suspended its ordering systems in Luxembourg as a precaution.

How it worked and what it cost

Stephan Moelans, CEO of Belgian refrigeration firm Sabcobel, told the Belga news agency that the units' evaporators were switched to defrost mode, which makes them warm up. The BBC reports that this is believed to be the same method used in France. His technicians were mobilized from 1 a.m. and spent the night and morning disconnecting affected units from the network.

Store managers reported temperatures as high as 50°C (122°F). One Swedish ICA Kvantum branch in Sjöbo wrote on Facebook that its fridges and freezers had been hacked and set to 50 degrees. Belgian media reports cited by Euronews put some readings at 70°C.

No total loss figure exists. A Delhaize branch in Hoeilaart, Flanders, told Het Laatste Nieuws it lost €100,000 (£83,500) of produce, not counting the cost of closing the shop. In France, individual stores reported losses from tens of thousands of euros to more than €130,000, and two Alsace stores reported a combined €270,000.

Who is responsible and who is investigating

No one has been identified, and no group has claimed responsibility. It is also not confirmed that Monday's incidents are linked to the French attacks or exploited the same software vulnerabilities, Politico Europe reports.

Belgium's Centre for Cybersecurity said it is aware of the incident and following it. Spokesperson Katrien Eggers said the agency has no further information. Sweden's national cybersecurity centre is responding to multiple incidents. Its head, John Billow, said the centre has recently found "quite a lot of exposed operational technology devices in Sweden" that need to be updated or patched.

In France, the Paris prosecutor's office has opened a formal investigation, citing "food losses and fires." Prime Minister Sébastien Lecornu ordered the national cybersecurity agency ANSSI to investigate. Ahold Delhaize reported a cybersecurity incident to Dutch police last month. The sources do not say whether that report relates to Monday's events.

The patching dispute

The French attack hit controllers mostly supplied by Danish manufacturer Danfoss. Danfoss said it identified security flaws last year and had "long recommended" that customers install updates. That puts responsibility on the operators.

Moelans described the problem differently. He said Sabcobel has been working since the French attack to protect customers' fridges against the vulnerability, but the units need physical modifications, not just software updates. "The simplest solution is to manage the fridges over a secure internet connection," he said. Most of Sabcobel's customers switched to that after France, he added. The units hit Monday were evidently not yet protected.

The Associated Press reports that the French attacks appeared to target old systems. Remote access for maintenance and failure alerts is standard in supermarket cold aisles, and that same connection is what the attackers used in France, where they also disabled alarms.

What comes next

The immediate job is cleanup and disconnecting units still exposed. Whether physical modifications can reach every affected unit before the next attempt is unanswered. So is the attackers' identity, and whether the Paris investigation will cover the new incidents across six countries.