Supermarket chains in Sweden, Belgium and Luxembourg have said that refrigerator and freezer temperatures rose overnight in dozens of stores, foreign media reported on Monday.
The incidents have raised fears of a cyber-attack like the one that caused millions of euros in food losses in France.
According to the reports, Sweden’s Coop said that the incident affected six of its stores. ICA said that it was “aware that a limited number of stores were affected by an incident overnight which impacted their refrigeration and freezer systems.”
Dutch retailer Ahold Delhaize, which reported a cybersecurity incident to police in the Netherlands last month, said an “IT incident” hit fridges and freezers in dozens of its supermarkets in Belgium and Luxembourg. Spokesperson Sarah De Meester said that the company found that temperatures in the cooling systems had risen and that an investigation is under way.
Belgian media reported that the affected sites included five Spar stores, several Shop & Go convenience stores at Q8 service stations and a number of smaller Proxy Delhaize minimarkets.
“We started mobilising technicians at 1am,” Stephan Moelans, chief executive of refrigeration installer Sabcobel, said. “We spent all night and morning disconnecting the affected installations from the grid.”
Last month, French police said that hackers took control of cooling units at up to 700 supermarkets. The attackers remotely changed the settings on thousands of freezers, fridges and chiller cabinets, pushing temperatures from as low as -27C to well over 50C. The affected chains included Intermarché, Coopérative U, Carrefour, Leclerc and Monoprix.
Stores threw away large amounts of fresh meat, dairy and frozen products. Many lost between tens of thousands of euros and more than €130,000. Two stores in Alsace reported a combined loss of €270,000.
Most supermarket cold aisles connect to the internet so staff can carry out remote maintenance and receive alerts when systems fail. In France, the hackers took over controllers mostly supplied by Danish company Danfoss. They disabled the alarms, then changed the thermostats or extended the defrost programme by hours.
Danfoss said that it identified security flaws last year and had “long recommended” that customers install updates.
The Paris prosecutor’s office has opened a formal investigation. It said the damage included “food losses and fires.” Prime Minister Sébastien Lecornu told France’s national cybersecurity agency, ANSSI, to investigate. ANSSI later confirmed that the attack also targeted supermarkets using controllers from two other companies.
