Cyberattacks on European supermarkets: What happened and who is behind them?

A new wave of cyberattacks targeting supermarket refrigeration systems has hit Europe, just weeks after a similar large-scale attack in France.

According to Report's European bureau, the incidents have affected several countries across continental Europe, as well as Ireland.

Speaking at a briefing in Brussels on November 3, European Commission spokesperson Thomas Regnier said the Commission was in direct contact with EU member states and national competent authorities conducting investigations.

He said two meetings had been convened that morning, including one with the EU's interinstitutional working group and European agencies.

The possibility that the attacks may have been organized by a state actor, particularly Russia, remains an open question. European authorities have not identified those responsible so far.

Where the attacks took place

According to Reuters, AFP and Euronews, refrigeration system problems were reported on November 2 in Belgium, Sweden, the Netherlands, Ireland, Estonia, Luxembourg, Finland and Portugal.

Belgium was among the hardest-hit countries. Problems affected several dozen Delhaize stores, around 15 Carrefour outlets, as well as Intermarché, Colruyt and other retail locations. A similar disruption was reported at an IKEA store in Mons. Belgium's Federal Prosecutor's Office has launched an investigation.

Delhaize also reported problems with refrigeration systems in Luxembourg. In Sweden, stores belonging to the ICA and Coop chains were affected. In some cases, freezer temperatures reached 50 degrees Celsius. In the Netherlands, problems were reported at least 17 small shops and butcher's stores.

Musgrave, the owner of Ireland's SuperValu chain, reported incidents at 13 stores. In Finland, disruptions were reported at several K Group outlets, while seven Intermarché stores were affected in Portugal.

In Estonia, only one incident was reported, at a Selver store, and it was quickly contained. According to AFP reports on November 3, incidents were also recorded in Italy.

This brings the number of countries reporting similar attacks to nine. However, the scale of the damage and confirmation that the incidents were specifically cyberattacks vary from country to country.

Scale of the damage

The most serious consequences were recorded in France on the night of October 11–12. The attack affected hundreds of stores belonging to Intermarché, Coopérative U, Carrefour, E. Leclerc, Monoprix and Netto. Hackers altered refrigeration system settings, raising temperatures to between 50 and 80 degrees Celsius. Some stores were forced to dispose of almost their entire stocks of frozen products.

According to French media reports, losses at individual supermarkets exceeded €130,000, while total damage could amount to tens of millions of euros. The latest incidents in Belgium are estimated to have caused losses of nearly €100,000 due to spoiled food.

However, the issue goes beyond the financial losses incurred by individual retail chains and also raises concerns about food security. Such attacks can disrupt infrastructure used to store food.

How did hackers gain access, and why were refrigeration systems targeted?

Preliminary investigations suggest that the attacks did not involve hacking refrigerators themselves, but rather the industrial control systems used to manage refrigeration equipment.

A software vulnerability is considered the main line of inquiry. In particular, some incidents have involved refrigeration management systems made by Danish manufacturer Danfoss. Devices running outdated software may have remained accessible over the internet.

Hackers may also have been able to change refrigeration settings because remote access to the systems was available. Experts have additionally pointed to the large number of industrial controllers exposed online. According to Euronews, a new study identified nearly 13,000 refrigeration controllers accessible online in 99 countries.

Danfoss had previously warned customers about the need to update their software. However, experts note that this may not be enough in some cases: changes to the physical configuration of systems and secure remote-access arrangements may also be required.

Who is behind the attacks: sabotage or cybercrime?

So far, no group has claimed responsibility for the October and November attacks. European law enforcement agencies have also yet to establish whether the incidents are connected.

Experts are considering several possible motives: sabotage, vulnerability testing - using poorly protected systems to demonstrate capabilities or prepare for larger-scale attacks - and cybercrime aimed at extortion.

However, no ransom demands have been reported following the takeover of the systems, at least publicly.

The possibility of Russia or another state being involved remains under discussion. So far, there is no publicly available evidence linking the attacks to any specific state or political campaign.

The key takeaway: The recurrence of attacks in France and subsequently in several European countries highlights how vulnerabilities in digital systems controlling refrigeration equipment can pose a threat to food supply infrastructure.

An important question for investigators is whether the attacks were organized by a single group or whether different perpetrators independently exploited the same technical vulnerabilities.