EU Promises Cyber Response as Supermarket Food Spoils

Hackers raised temperatures in supermarket refrigeration systems in Germany, Romania and the United Kingdom on Monday, spoiling tonnes of food and bringing the number of European countries hit in the spree to at least 11. The EU says the attacks are “not isolated” and is promising a collective response. Their motive remains unknown; nobody has claimed responsibility.

A collective response, still taking shape

Problems were reported on Monday in at least nine EU countries: Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden. On Tuesday, officials and company representatives reported attacks at four supermarkets in Germany and six in Romania. The UK, which is not in the EU, was also affected.

Thomas Regnier, a spokesperson for the EU, said the bloc’s agencies were talking with national authorities about a joint response. “These are not isolated incidents, and of course, we have to be collectively resilient and prepared for such cyber incidents,” he said. He declined to identify potential culprits. The public has the warning and the promise of coordination; the cause of the attacks has not been established in the information released.

Dan Cimpean, the director of Romania’s National Cyber Security Directorate, said the attacks appeared limited in sophistication and that he did not suspect a state actor. “It seems semi-amateurish,” he told the AFP news agency. “We do not suspect, under any circumstances, that it is a state actor.” He added that “no other infrastructure was compromised”. The motive remains unknown, and no one has claimed responsibility.

Empty shelves, official reassurances

Belgium was among the hardest-hit countries on Monday, with dozens of stores across several grocery chains reporting refrigeration failures. Federal prosecutors have opened an investigation. In Italy, about 20 supermarkets were affected. Giuseppe Spadaro, director of a group that runs Coop supermarkets in Sicily, said four of its 300 stores were hit, causing thousands of euros in damage. “We had to throw away everything. The shelves are empty,” he told Italy’s Corriere della Sera newspaper.

Italy’s government held talks with the heads of the intelligence services and the National Cybersecurity Agency on Tuesday. Prime Minister Giorgia Meloni’s office described the impact as “limited” and said: “There is no cause for alarm, although all the relevant institutional bodies remain on high alert.” The shelves Spadaro described were empty all the same.

In the UK, hackers tried to target small meat-processing firms, but the impact was minimal, said Richard Horne, chief executive of the National Cyber Security Centre (NCSC). Horne told the BBC the issue affected “the whole food supply chain” and that there had been a couple of instances where “vulnerable technology had been exploited”.

Old systems, urgent fixes

The second wave followed a cyberattack that swept hundreds of supermarkets across France in October and also affected stores in several other European countries. In Sweden, Coop said refrigeration equipment affected overnight at seven stores had been connected to “old 4G networks”. Those stores have since resumed normal operations.

Carlos Cancinos, a spokesperson for the chain, said Coop had accelerated an upgrade begun after the October attacks, moving connected refrigeration equipment to 5G networks and modern modems. “This helps to solve a large share of problems of this kind,” he said. Danfoss, a Danish maker of refrigeration controls whose systems were again among those targeted, said it had been in close contact with customers for the past three weeks. It recommended that the systems not be directly accessible from the internet.

Frank Groenewegen, a cybersecurity expert at Deloitte in The Hague, urged retailers to check whether refrigeration controllers were connected to the internet and running the latest security updates. “And if they don’t even know, then remove them from the public internet immediately,” he told the Reuters news agency. “With disconnecting, you haven’t fixed the root cause, but you’ve at least isolated those systems so that an attacker is not able to do this anymore.” The advice draws a clear line between containing the immediate risk and fixing its root cause. For stores that have already thrown food away, isolation comes after the damage.