Freezer cyberattack hits seven European countries in second wave
Web StoryWatch this story in 15 seconds →Key takeaways
- Hackers forced supermarket fridges and freezers into defrost mode on Sunday night. Seven European countries were hit.
- Around 40 Delhaize stores in Belgium and Luxembourg were hit. Thirteen SuperValu stores in Ireland pulled food from sale.
- Britain's cyber security chief says a small number of UK cases have appeared. Meat processing firms are among them. The national impact is minimal so far.
Hackers have hit supermarket freezers across Europe a second time. They pushed fridge and freezer units into defrost mode overnight into Monday. Stores in seven countries woke up to warm cabinets.
They had to throw away food.
What happened
Shop staff across northern and western Europe arrived on Monday morning to find warm refrigerated cabinets. Freezers were defrosting on their own. According to the BBC, the attack touched seven countries.
They were Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia, and Finland.
Around 40 Delhaize supermarkets in Belgium and Luxembourg were affected. Delhaize said it had identified an IT incident affecting refrigeration in several dozen stores, Euronews reported. Carrefour said 15 of its roughly 700 Belgian stores were hit.
Its spokesman, Mich Vergauwen, told The Journal: "It's a cyberattack, there is no other reason."
Intermarche Belgium had 15 stores affected, according to Le Soir. Colruyt Group runs Spar stores in Belgium as franchises. It told Reuters that five shops had their fridge systems attacked.
In Ireland, Musgrave pulled chilled and frozen products from sale at 13 SuperValu stores. Branches in Blanchardstown, Lucan, and Waterford were among them. In Sweden, a small number of ICA stores were hit.
Seven of Coop's 800 stores were also affected. The Netherlands saw at least 17 companies affected, according to Danfoss. K-stores in Finland reported malfunctions under investigation.
In Estonia, at least one Selver store was affected.
Some units reportedly reached temperatures as high as 50C. The losses are adding up. A Delhaize branch in Hoeilaart told Het Laatste Nieuws it had lost 100,000 euros of produce.
That was before counting the closure costs. The BBC says local media reported millions of euros worth of food thrown away. This happened across the affected countries.
One Delhaize manager, Mathieu Tilman, told the BBC the waste was truly distressing. This comes at a time when many people do not have enough to eat.
The attack worked the same way as the first wave in France. Stephan Moelans leads Sabcobel, a Belgian refrigeration company. He told the Belga news agency that the units' evaporators had been switched into defrost mode.
He described it as a cyber-attack. He said the attackers used the same method. It matches the French incident in October.
Sabcobel operates systems for Delhaize. It knows of around 20 affected units out of hundreds it manages, Euronews reported.
Why it matters
This is the second wave in three weeks. The first struck French supermarkets on the night of October 11. French finance minister Roland Lescure told parliament about 700 supermarkets were hit.
Groupement Mousquetaires said 300 of its Intermarche and Netto stores were affected. We covered that wave last month. See French supermarkets were hit by a cyberattack that heated fridges to 50C.
This wave is wider, and it has reached Britain. The National Cyber Security Centre is aware of a small number of UK cases. In these, vulnerable technology was exploited.
The British Association of Independent Meat Suppliers spoke to the BBC. It said some of its more than 300 members had become caught up in the attacks. None of the affected members had lost any meat, the association stressed.
Its head of communications, Tony Goodger, urged members and the wider sector to stay vigilant.
Speaking at the report launch on Tuesday, Paul Chichester, the NCSC's director of operations, said: "We're aware of those incidents in the UK. We're working with the affected organisations."
"We'll keep monitoring that. At the moment, the impact is minimal."
The weakness the hackers used is simple and old. Britain's cyber chiefs say the attacks involved legacy technology connected to the internet with default passwords. After the French attack, France's national cyber-security agency said it was aware of many compromises.
These involved remote control modules made by Danfoss of Denmark and Copeland of the United States. Security firm Claroty had flagged flaws in Danfoss and Copeland controllers in an August report. Both makers have since released fixes.
The gap is familiar to anyone who keeps up with software updates. Freezer cabinets can run for more than a decade. Their controller software may be years out of support.
Sabcobel's Moelans said his firm had been working since the French attack to protect customers. But the units needed physical changes, not just software updates.
British supermarkets look exposed too. UK Cyber Defence shared research with The Grocer. It found more than 800 UK retailer fridge and building controllers reachable from the open internet.
Fifteen Danfoss units in the UK were unlikely to have been patched. Peter Bassill, founder of UK Cyber Defence, spoke to The Grocer about the exposure.
"The ingredients are the same here. Only the brand on the box is different."
The run-up to Christmas is the busiest season for supermarkets. A refrigeration failure in December would cost far more in lost food. For shoppers, the rules are clear.
Chilled food must legally be kept at 8C or below in England, Wales, and Northern Ireland. Food that is not of good quality can be returned for a refund. This right comes from the Consumer Rights Act 2015.
What happens next
Nobody has claimed responsibility for either wave. Investigators in France and Belgium have opened criminal inquiries. National cyber agencies in Belgium and Sweden are monitoring the situation.
Belgium's federal prosecutor has opened an investigation into the new wave, Euronews reported.
Investigators are still establishing how the intruders got in. They are also checking whether the British cases are linked to the continental attacks. The BBC reported this.
Officials have not commented on who they suspect.
NCSC chief executive Richard Horne used Tuesday's report launch to press a wider point. He said teams had worked through the night to alert British firms with vulnerable technology. "Last night, we had people working through the night contacting organisations," he said.
"We could see they had vulnerable technology exposed." He warned that Britain has done "tech on the cheap" for decades. He urged organisations to renew aging systems.
His advice echoes wider cyber security warnings seen this year. Treat security as a basic cost of doing business, not an afterthought.
The NCSC's annual report covers this year's cyber attacks. Its incident management team received 1,831 reports. Of those, 337 needed support.
And 80 were nationally significant. The team also warned 8,500 organisations that their systems had been compromised.
For now, stores are cleaning up and restocking. But the same unlocked doors are still open. The next wave could find them again.
Related stories
Apple plans two October launches: smart home hub, OLED MacBook Pro
Apple set October 13 for a smart home launch with a new hub, Apple TV 4K and HomePod mini, then October 27 for OLED MacBook Pro models
How to Check If Your Phone Supports eSIM in 30 Seconds
Dial *#06# and look for an EID number to confirm eSIM support in under 30 seconds. This guide also walks through the iPhone and Android
eSIM vs iSIM: what is the difference?
An eSIM is a dedicated chip on the phone's board, while an iSIM lives inside the processor itself. Qualcomm's Snapdragon 8 Gen