Cyber-attack hits supermarket fridges and freezers in seven European countries
The BBC reports that dozens of shops in Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia and Finland had refrigeration units remotely switched to defrost.
A cyber-attack has hit refrigerators and freezers in dozens of supermarkets across seven European countries, according to the BBC. This article is based on that single report.
The BBC said around 40 Delhaize supermarkets in Belgium and Luxembourg were affected. A smaller number of shops were hit in Sweden, Ireland, the Netherlands, Estonia and Finland.
Sabcobel is a Belgian company that makes some of the affected refrigerators and operates Delhaize's systems. It said the units' evaporators were switched to defrost mode, which made them warm up. The BBC reported that this is believed to be the same method used in an incident last month that hit hundreds of French supermarkets. Local media reported at the time that millions of euros worth of food had to be thrown away in October.
Stephan Moelans, Sabcobel's chief executive, told the Belga news agency on Monday that the incident was a cyber-attack. He said the company had been "working all night and morning to disconnect the affected units from the network". He said that since the French attack, the company had been working to "protect our customers fridges against this vulnerability", but that the units needed physical modifications and not just software updates.
“"The simplest solution is to manage the fridges over a secure internet connection. Most of our customers switched to that after the attack in France."”Stephan Moelans, CEO of Sabcobel
Freezer temperatures in several shops reportedly rose as high as 50C (122F), the BBC said. A Delhaize branch in Hoeilaart, Belgium, told Het Laatste Nieuws it had lost €100,000 worth of produce. Its manager said that figure did not include further losses from closing the shop.
The BBC listed other affected businesses. Carrefour said 15 of its Belgian stores were affected. Colruyt Group told Reuters that five Spar shops were hit. Ikea said its store in Mons was affected, and a spokesman told Reuters "we cannot rule out that additional locations may be affected". In Sweden, several ICA shops and seven of Coop's 800 stores were hit. In Ireland, Musgrave Group told The Irish Times that 13 SuperValu supermarkets were affected, and said the impact was limited to a "specific model" of refrigerator. Danfoss told Dutch broadcaster NOS that systems at at least 17 companies in the Netherlands were attacked. A Selver supermarket in Estonia was also affected, according to ERR.
The incident matters because, as the BBC noted, most supermarkets across Europe are linked to the internet, and their maintenance and troubleshooting can be done remotely. The national cyber-security agencies of Belgium and Sweden said they were monitoring the incident. The UK's National Cyber Security Centre said it was working with partners to "fully understand details of an incident". No incidents have been reported in the UK.
Several questions are still open. The BBC said it is unclear who is behind the attack. In the US, authorities are investigating refrigeration malfunctions at a number of military bases in August and are working with French officials to see whether the incidents could be linked. In Finland, Kesko's security experts are still investigating malfunctions at some K-stores, Helsingin Sanomat reported.
