A cyberattack on commercial refrigeration systems has disrupted more than 115 supermarkets and other retailers across Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia. The attackers remotely changed freezer and refrigerator settings, in some cases shutting down equipment or activating defrost cycles, causing temperatures to rise, food to spoil and store employees to intervene overnight or early in the morning.
Dozens of supermarkets were found to have malfunctioning refrigeration equipment, although it remains unclear whether the stores were affected by a coordinated attack or targeted individually.
More than 115 stores affected across Europe
Spokespeople for several supermarket chains confirmed the refrigeration problems in statements to BleepingComputer. The affected retailers include:
- ICA (Sweden): At least four locations
- Coop (Sweden): Seven locations
- Ahold Delhaize (Belgium and Luxembourg): Approximately 40 locations
- Carrefour (Belgium): 15 stores
- Spar Colruyt (Belgium): Five locations
- Intermarché (Belgium): Approximately 15 locations
- SuperValu (Ireland): 13 stores
- Selver (Estonia): One store
At least 17 butcher shops and neighborhood stores were also affected in the Netherlands. In Belgium, other businesses reported similar problems, including the IKEA superstore in Mons, a grocery store and a chocolate shop.
Refrigeration systems shut down or overheated
ICA, Ahold Delhaize and Spar Colruyt said they were assisting affected stores and working to resolve the incident.
“We can confirm that we were made aware overnight of an incident that affected a small number of ICA stores operating outside of ICA’s central network,” an ICA spokesperson said.
“This incident affected the store’s refrigeration and refrigeration systems. ICA is currently assisting in managing the situation at the affected store.”
A representative from Colruyt Group said the refrigeration systems at approximately five Spar stores had been affected.
“These stores are run by independent entrepreneurs with their own refrigeration systems. We are currently doing everything we can to resolve this issue,” the representative said.
Ahold Delhaize said the IT incident affected refrigeration systems at dozens of stores and that it “immediately took the necessary steps to maintain store operations.”
“We have confirmed an IT incident impacting refrigeration systems in dozens of stores,” the company’s communications department said.
Coop, one of Sweden’s largest grocery chains, said seven of its more than 800 stores were affected. The company said the situation was contained and under control, but reported that some refrigerators and freezers had stopped working, while others were only partially operational.
“Overnight into Monday, we can confirm that a small number of stores were affected, specifically seven out of over 800 stores,” Coop told BleepingComputer.
“The situation is currently contained and under control. Issues range from refrigerators and freezers that have stopped completely to partially functioning units. In some cases, systems have begun to generate heat.”
Carrefour says all stores remain open
Carrefour said the incident affected stores in two Belgian regions, but none of its hypermarkets. The company said all locations remained open after staff took swift action.
“The impact on Carrefour is very limited. Currently 15 of our 700 stores are affected, both in Flanders and Wallonia,” Carrefour said.
“None of the large supermarkets are among them. All stores remain open as the problem only concerns a small number of refrigeration units, mainly freezers. Swift action was taken to ensure all stores remain open.”
An ICA store manager told TV4 that temperature settings were changed overnight to +50°C (122°F) and could not be altered. The affected stores were forced to discard frozen food.
According to RTL Media, Ahold Delhaize alerted store managers by SMS at around 4 a.m. about the refrigeration problem. Some stores reportedly used refrigerated trucks to protect their stock.
Attack may have exploited a known refrigeration vulnerability
RTL identified Subcobel as a vendor supplying refrigeration systems in some of the affected areas. Sabcobel director Stephan Moelans said the attackers exploited the same vulnerability involved in a similar attack in France last month.
Moelans said technicians began disconnecting affected equipment at 1 a.m. and attributed the disruption to a remotely activated defrost function. He said protecting customers’ systems requires more than a software update because the refrigeration equipment also needs physical modifications.
“The simplest solution is to manage the refrigerator through a secure internet connection. Since the attacks in France, most of our clients have adopted this solution,” Moerans told RTL.
BleepingComputer said it contacted Sabcobel for more information about the incident and the company’s level of involvement, but was still awaiting a response.
A similar refrigeration attack in France last month affected hundreds of stores. According to a French cybersecurity alert, Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB refrigeration controllers were compromised and remotely switched to defrost mode.
Source: www.bleepingcomputer.com