Supermarket fridges and freezers sabotaged overnight in Sweden and Belgium in suspected cyberattack
Refrigeration systems at dozens of supermarkets in Sweden and Belgium were disrupted overnight into Monday, 2 November. Several ICA stores in Sweden say their fridges and freezers were hacked and set to about 50°C, and Coop reports problems at six stores. In Belgium, Delhaize confirms an "IT incident" at about 40 stores, Carrefour at 15 and Spar at about five. Stores had to throw food away. Nobody has claimed responsibility, and no official link to last month's attack on French supermarket fridges has been confirmed.
Shop managers in Sweden and Belgium arrived on Monday morning to warm freezers, puddles of water and food that had to be thrown away. Overnight into 2 November, the refrigeration systems of dozens of supermarkets in the two countries stopped working or started heating instead of cooling. Several stores say they were hacked. The retail chains are more cautious and speak of an "incident" that they are still investigating.
In Sweden, the ICA group confirmed that "a limited number of stores" had been hit by an overnight incident affecting their refrigeration and freezer systems, press officer Gustaf Nilsson told Swedish media. He said the affected stores are connected outside ICA's central network and that the group is helping them handle the incident. Stores named by Aftonbladet, Expressen and SVT include ICA Kvantum in Sjöbo and Tomelilla, ICA Nära Sankt Olof and ICA Nära Böda on Öland, ICA Supermarket Baronen in Stockholm and ICA Nära Viken in Karlstad.
ICA Kvantum in Sjöbo wrote on Facebook that its freezers had been set to 50°C. "We can't adjust the temperatures, we can't change them. Hot air is blowing in the freezers. Everything is ruined," store manager Rickard Nilsson told TV4, estimating the loss at several hundred thousand kronor. The manager of ICA Nära Böda told SVT that he found water on the floor and a freezer at 55°C. Coop says fridges and freezers fully or partly stopped working at six of its stores in Gästrikland and Hälsingland, around Gävle. Its press chief Carlos Cancino said the cause has not been established, but that there are similarities with the attack in France.
In Belgium, Delhaize spokesperson Sarah De Meester confirmed an "IT incident" affecting fridges and freezers at about 40 stores in both Flanders and Wallonia, and told Reuters that stores in Luxembourg were also hit. According to RTL Info and VRT, Delhaize sent out an alert about sudden temperature rises at around 4 a.m., and temperatures climbed to about 15°C. Carrefour Belgium reported 15 affected stores and said it was still analysing the situation, while Colruyt Group said about five independently run Spar shops had similar problems. VRT noted that it is not yet clear whether it was a cyberattack.
The butcher chain De Laet & Van Haver told Belga that the parameters of its refrigeration systems had been changed from outside at around 3 a.m., putting the evaporators into defrost mode, but staff paused the systems before the temperature rose too far. Others were less lucky. The Delhaize store in Hoeilaart stayed shut until noon, and its manager told HLN that almost all frozen products were thrown away, with a loss of at least €100,000. A Delhaize Proxy shop in Hoepertingen estimated its loss at about €60,000.
The incidents closely resemble the attack of mid-October on French supermarkets, when hackers remotely switched on defrost cycles in refrigeration controllers, causing large food losses and some fires. The Paris prosecutor's office opened an investigation, and France's cyber agency ANSSI said controllers from Danfoss, Copeland and Dixell were targeted. Danfoss said at the time that many affected units were running outdated software. Expressen reported that two of the Swedish stores it contacted use Danfoss refrigeration equipment, though no supplier has been confirmed for Monday's incidents. Belgium's Centre for Cybersecurity had already advised in October that refrigeration systems should not be connected directly to the internet. Nobody has claimed responsibility, and the authorities have not linked the new incidents to the French attack.