Brussels Warns After Supermarket Fridges Are Hacked

Cyberattacks sent supermarket fridges and freezers across Belgium and several other European countries to dangerous temperatures overnight from Sunday into Monday, Nov. 2. Food spoiled, revealing how much ordinary food supply relies on vulnerable systems. Stores in Belgium, Sweden, the Netherlands, Estonia, Luxembourg, Finland and Ireland were affected. No one has claimed responsibility.

Food Systems, Under Attack

Euronews reported that about 40 Delhaize Proxy supermarkets, 15 Carrefour Shop & Go stores, 15 Intermarché shops and five Spar Q8 service station locations were hit in Belgium. De Laet en Van Haver and an IKEA shop in Bergen, Mons, also reported incidents, bringing the Belgian total to 75 stores, according to Euronews. Carrefour said 15 of its 700 stores in Flanders and Wallonia were affected; no hypermarkets were involved.

“All stores remain open because it only concerns a few refrigeration units, mainly freezers,” Carrefour said. “Quick action was taken so that all stores can stay open.” Company spokesman Mich Vergauwen called it a cyberattack and described the impact as “very limited.” Yet food in Belgian fridges had to be discarded after temperatures climbed as high as 17 degrees Celsius.

At 3:30 a.m., an employee woke Luc De Laet, founder and owner of De Laet & Van Haver. He found the fridges at his store south of Antwerp set as high as 18 C and estimated that about €15,000 ($16,800) worth of meat had been ruined. “It's very scary. They are hacking the system that is doing the registration of the temperature, and they can program it at a distance,” he told Reuters. De Laet contacted police, but he didn't know whether they had opened an investigation.

In Stockholm, the attack struck at 2 a.m., according to ICA franchise store sales manager Engla Ingwall, and staff noticed it hours later. “Everything is destroyed,” she said. “There has been a cyberattack and all our freezers reached 50 degrees (Celsius).” Unauthorized tampering with refrigeration systems affected seven of Swedish grocer Coop’s 800 stores.

Investigation, Without an Identified Attacker

Belgium's federal prosecutor's office opened an investigation. Katrien Eggers, spokesperson for Belgium's Centre for Cybersecurity, said no reports identified who was behind the attack, and “it may never be determined.” Sweden's national cybersecurity centre also opened an investigation.

The damage reached beyond Belgium and Sweden. Musgrave said the incident hit systems in 13 SuperValu stores in Ireland, prompting it to remove some chilled and frozen products from sale. Danfoss said attackers targeted cooling systems at least 17 companies in the Netherlands, without naming them. Media reports described an incident at one Estonian Selver location; Finnish media reported that several K Group supermarkets were affected, while Delhaize suspended ordering systems in Luxembourg as a precaution. Reuters also reported that an IKEA store in Belgium was affected.

Danfoss supplied software for refrigeration systems affected in these incidents and in a similar French attack on Oct. 12. The company said customers who hadn't updated their software were affected. Belgian attack used the same mechanism as the French incident, said Stephan Moelans, CEO of refrigeration installer Sabcobel. Software updates alone weren't enough, he said; physical modifications were needed. “That requires investment.” Sabcobel knew of about 20 affected units among the hundreds it manages in Belgium.

The European Commission said the incidents showed digital threats were becoming increasingly disruptive. EU commissioner for agriculture Christophe Hansen called them “a deliberate attempt to disrupt our food supply chain and undermine consumers' confidence in it.” The official warning names the threat, but it doesn't identify the attacker. Reuters said it couldn't establish who was behind Monday's incidents or whether they were linked to the French attack.

Retail chains run large networks of refrigeration controllers, building management systems, door access panels and point-of-sale equipment, said Tom Hegel, a researcher at cybersecurity firm SentinelOne. Tracing attacks can be difficult: “A teenager and an intelligence service would look much the same from the defender's side.” The cause and responsibility remain unresolved. The ruined food, and the stores left managing the damage, are not.