Hackers disrupt refrigeration at more than 115 supermarkets across Europe

A cyberattack on refrigeration systems has disrupted stores run by multiple supermarket chains across several European countries, after hackers remotely changed temperature settings on freezers and cooling systems. In some cases, the attackers shut down refrigerators or activated defrosting systems, causing temperatures to rise. The tampering led to significant product losses and forced store managers to intervene early in the morning. Refrigeration failures were identified at dozens of supermarkets, though it remains unclear whether the stores were hit in a coordinated attack or targeted individually. More than 115 stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia have been affected, and spokespersons for multiple chains confirmed the issues to BleepingComputer. In the Netherlands, at least 17 butcher shops and neighborhood stores were hit, while affected locations in Belgium include an Ikea superstore in Mons, grocery stores, and chocolate shops. Chains including ICA, Ahold Delhaize, and Spar Colruyt told BleepingComputer they are supporting affected stores and working to resolve the situation. ICA's press officer said the company was informed of an incident overnight affecting a small number of ICA stores operating outside its central network, and that the incident impacted those stores' refrigeration and freezer systems. A representative of the Colruyt Group said there is an impact on the refrigeration systems at around five Spar stores. Those stores are operated by independent entrepreneurs who have their own refrigeration systems, and the group said it is doing everything it can to resolve the issue. Ahold Delhaize separately confirmed an IT incident affecting the refrigeration systems in several dozen stores, saying it immediately took the necessary measures to keep its stores operational. In Sweden, Coop said a small number of its stores were affected overnight into Monday, specifically 7 out of more than 800. The company said the situation is contained and under control, with issues ranging from completely shut-down refrigerators and freezers to partially functioning units, and in one case a system beginning to generate heat. In Belgium, Carrefour said 15 of its 700 stores were affected across Flanders and Wallonia, with no hypermarkets among them. All Carrefour stores remained open, as the problems concerned mainly a few refrigeration units, primarily freezers. An ICA store manager told TV4 that temperature settings had been changed overnight to +50°C (122°F) and could not be modified, forcing the store to discard frozen food. According to RTL, Ahold Delhaize warned managers by SMS around 4 a.m. about the refrigeration issues, and some stores used refrigerated trucks in an attempt to preserve stock. RTL also identified Sabcobel as the vendor of refrigeration systems at several of the impacted locations. Sabcobel's director, Stephan Moelans, said the attacker leveraged the same vulnerability used in similar attacks in France last month. According to Moelans, technicians began disconnecting affected installations from 1 a.m., and he attributed the disruption to remotely activated defrost functions. He noted that a simple software update is not enough, as the refrigerators also require physical modifications, and said the simplest solution is to manage the refrigerators via a secure internet connection, which most of the company's clients have adopted since the attack in France. BleepingComputer has contacted Sabcobel for further comment but is still awaiting a response. The attacks follow an earlier campaign in France last month, in which hundreds of stores using Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB refrigeration controllers were compromised by remote attackers who set the devices to defrost mode.