Cyber-attack disables shop freezers across seven European countries

Dozens of supermarkets across seven European countries have been hit by a cyber-attack targeting their refrigerators and freezers, forcing stores to empty units and throw away spoiled stock. Around 40 Delhaize supermarkets in Belgium and Luxembourg were affected, while a smaller number of shops were hit in Sweden, Ireland, the Netherlands, Estonia and Finland. Sabcobel, the Belgian company that manufactures some of the affected refrigerators and operates Delhaize's systems, said the units' evaporators were switched to defrost mode, causing them to warm up. The company believes the same method was used in last month's incident that hit hundreds of French supermarkets, when millions of euros worth of food had to be thrown away, according to local media reports at the time. Stephan Moelans, Sabcobel's chief executive, told the Belga news agency on Monday that the incident was a cyber-attack and that the company had been working through the night and morning to disconnect the affected units from the network. He said that since the French attack in early October the company had been working to protect customers' fridges against the vulnerability, but that the units needed physical modifications rather than just software updates. Most supermarkets across Europe are linked to the internet, allowing maintenance and troubleshooting to be carried out remotely. "The simplest solution is to manage the fridges over a secure internet connection. Most of our customers switched to that after the attack in France," Moelans said. The temperature of freezers in several shops reportedly rose to as high as 50C (122F). It is unclear who is behind the latest apparent attack. Belgium and Sweden's national cyber-security agencies said they were monitoring the incident. The UK's National Cyber Security Centre said it was working with international partners and industry to fully understand details of an incident, although no incidents have been reported in the UK. In the US, authorities are investigating what caused refrigeration malfunctions at a number of American military bases in August and are working with French officials to examine whether the incidents could be linked. In Flanders, northern Belgium, a Delhaize branch in Hoeilaart told news website Het Laatste Nieuws it had lost 100,000 euros (£83,500) worth of produce, an estimate the manager said did not take into account further losses from closing the shop. Carrefour said the incident had affected only 15 of its Belgian stores and that measures were taken immediately to ensure all shops remained open. Colruyt Group, which operates Spar stores in Belgium under a franchise system, told Reuters that five shops had their fridge systems attacked. Ikea said refrigeration systems at its store in the western Belgian city of Mons were affected, with a spokesman saying the company could not rule out that additional locations may be affected. In Sweden, several ICA and Coop shops were hit. A spokesperson for ICA confirmed the incident had affected a small number of stores operating outside the company's central network and said ICA was supporting them in managing the situation. One ICA branch in Sjobo, southern Sweden, wrote on social media that its refrigerators and freezers had been hacked overnight and set to 50 degrees; the store closed earlier but has since reopened. Coop said seven of its 800 Swedish stores were affected and that the situation was currently contained and under control. Elsewhere, refrigerator malfunctions were detected in some K-stores in Finland, with chain owner Kesko telling the Helsingin Sanomat newspaper that its security experts were investigating the cause. In Ireland, 13 SuperValu supermarkets were affected, and Musgrave Group, which owns the chain, told The Irish Times that a cyber incident had hit its refrigeration systems but was limited to a specific model of refrigerator. Danish manufacturer Danfoss told Dutch public radio channel NOS that the freezing and cooling systems of at least 17 companies in the Netherlands were attacked overnight, affecting butchers' shops and small neighbourhood stores. In Estonia, a Selver supermarket was affected, with reports of other affected companies in the country, according to ERR.