A cyberattack disrupted refrigeration systems at supermarkets and other food retailers across Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia. Attackers remotely changed settings on freezers and cooling equipment, in some cases shutting down units or activating defrost functions that raised temperatures.
The incidents affected more than 115 stores, although it remains unclear whether they resulted from a coordinated campaign or separate attacks. Some retailers reported discarded frozen products, while staff intervened during the early morning to protect stock and restore operations.
Chains that confirmed affected locations include ICA and Coop in Sweden, Ahold Delhaize, Carrefour, Spar Colruyt and Intermarché in Belgium, SuperValu in Ireland, and Selver in Estonia. At least 17 butcher shops and neighborhood stores were also affected in the Netherlands. Other reported locations in Belgium included an Ikea superstore in Mons, grocery stores and chocolate shops.
Ahold Delhaize said refrigeration systems at several dozen stores had been affected by an IT incident and that it had taken measures to keep the stores operating. Carrefour reported that 15 of its 700 stores were impacted in Flanders and Wallonia, while all its hypermarkets remained open.
Coop said seven of its more than 800 Swedish stores were affected. The problems ranged from completely disabled refrigerators and freezers to partially working equipment; in one case, a unit reportedly began generating heat. ICA confirmed that a small number of stores outside its central network were affected and said it was supporting them.
An ICA store manager told TV4 that temperature settings had been changed overnight to 50°C, making it impossible to preserve frozen food. RTL reported that Ahold Delhaize warned managers by text message at about 4 a.m., with some stores using refrigerated trucks to protect products.
Sabcobel was identified as the refrigeration-system provider at several affected locations. Its director, Stephan Moelans, said the attacker used the same vulnerability involved in similar attacks in France the previous month and that technicians began disconnecting installations from 1 a.m. He attributed the disruption to remotely activated defrost functions.
Moelans said that a software update alone would not fully address the risk because the refrigeration systems also require physical changes. Sabcobel has not yet responded to BleepingComputer’s request for further information about the incident and its involvement.
Sources: BleepingComputer.