Malware · Incident Response
Supermarket freezers in seven European countries hacked, food spoiled
A cyber-attack caused supermarket freezers in seven European countries to heat up, forcing stores to throw away food worth millions of euros. The attack targeted remote-controlled refrigeration systems.
Ross Grant2 min read
The short version
Hackers broke into supermarket freezer systems in seven European countries, making them heat up instead of keeping food cold. This forced stores to throw away large amounts of spoiled food, costing some shops hundreds of thousands of euros. The attack worked by switching the freezers to defrost mode using their internet connections. It is not yet known who was behind the attack.
By the numbers
- 7European countries with affected supermarketsBBC
- 40Delhaize supermarkets in Belgium and Luxembourg affectedBBC
- €100,000Produce lost at one Delhaize branch in BelgiumBBC
- 15Carrefour stores in Belgium affectedBBC
- 13SuperValu supermarkets in Ireland affectedBBC
- 7Coop stores in Sweden affectedBBC
What happened?
A cyber-attack hit supermarket refrigeration systems in seven European countries, causing freezers to heat up and spoil food. Around 40 Delhaize supermarkets in Belgium and Luxembourg were affected, along with stores in Sweden, Ireland, the Netherlands, Estonia and Finland. Some stores lost hundreds of thousands of euros worth of produce. The attack method appears similar to one that hit French supermarkets last month. The source of the attack is not yet known, and only the BBC has reported these details so far.
Who is affected
Supermarkets in seven European countries were hit by a cyber-attack that targeted their refrigeration systems, according to the BBC (opens in a new tab). Around 40 Delhaize supermarkets in Belgium and Luxembourg were affected. Fewer shops were hit in Sweden, Ireland, the Netherlands, Estonia and Finland. In Sweden, ICA and Coop stores were impacted, with seven out of 800 Coop stores affected. In Ireland, 13 SuperValu supermarkets had issues. Butcher shops and small stores in the Netherlands were also targeted, as well as a Selver supermarket in Estonia. Ikea's store in Mons, Belgium, was affected, and the company said more locations could be at risk.
What was taken
No personal data was reported stolen. The attack caused the temperature in many freezers to rise as high as 50°C (122°F), spoiling large amounts of food. In one Delhaize branch in Belgium, the manager said €100,000 worth of produce was lost. Local media reported that millions of euros of food had to be thrown away in similar attacks in France the previous month.
How the attack worked
Sabcobel, which manufactures some of the affected refrigerators, said the attackers switched the units' evaporators to defrost mode remotely. This caused the freezers to heat up instead of keeping food cold. Most supermarket refrigeration systems are connected to the internet for remote maintenance and troubleshooting. Sabcobel's CEO said that after the French incident, they tried to protect fridges against this vulnerability, but some units needed physical changes, not just software updates. The attack method appears to be the same as the one used in France in October.
The response
Sabcobel said it worked overnight to disconnect affected units from the network. Most customers have now switched to managing fridges over a secure internet connection. National cyber-security agencies in Belgium and Sweden are monitoring the incident. The UK's National Cyber Security Centre is working with partners to understand the details, but no UK stores have reported problems. ICA in Sweden is supporting affected stores, and Coop said the situation is now under control. Kesko in Finland is investigating, and Musgrave Group in Ireland confirmed the impact was limited to a specific refrigerator model. Carrefour said only 15 of its Belgian stores were affected and that all shops remained open.
It is not clear who carried out the attack. Only the BBC has reported these details so far, and there is no confirmation from primary sources or vendors. Authorities in the US are also investigating similar incidents at military bases to see if there is a link.
Why it matters
This attack shows how internet-connected systems in shops can be targeted, causing real-world losses. It highlights the risks of managing critical equipment remotely without strong security. Food waste and business disruption can have a big impact on both stores and customers.
Key points
- Supermarket freezers in seven countries were hacked, causing food to spoil.
- Attackers used remote access to switch freezers to defrost mode.
- Some stores lost hundreds of thousands of euros in produce.
- Most affected systems were connected to the internet for maintenance.
- The source of the attack is not yet known, and only one outlet has reported it.
Sources
BBC
Reference
