Several food distribution chains in Europe have been affected by a new series of cyber attacks directed against their refrigeration systems. Among the affected companies are Ahold Delhaize and Colruyt in Belgium and Luxembourg, as well as the Swedish chains ICA and Coop, which have reported abnormal temperature increases in refrigerators and freezers in various establishments.
The Belgian Prosecutor's Office has opened a criminal investigation into the cyberattack that has affected several supermarkets in the country, according to a spokesperson.
The incidents occur just three weeks after the attack in France, where, according to police, cybercriminals managed to take control of the refrigeration systems of hundreds of supermarkets. In that case, temperatures reached 50 °C, causing losses of food products and even some fires.
In Belgium, the Delhaize chain detected temperature increases in several refrigeration equipment during the early hours of the morning. The company has opened an investigation to determine the origin of the incident. As Stephan Moelans, executive director of the refrigeration company Sabcobel, responsible for Delhaize's systems, told the Belgian agency, the attackers would have remotely activated the defrosting mode of the evaporators. For its part, Colruyt Group confirmed that five SPAR network establishments in Belgium were subject to similar attacks targeting their refrigeration systems.
These events highlight the growing vulnerability of operational technology (OT) systems. Traditionally mechanical equipment, such as refrigerators, heating systems, security cameras or alarm networks, are increasingly connected and managed remotely, expanding the attack surface available to cybercriminals.
Sweden investigates multiple incidents
Sweden's National Cybersecurity Center has confirmed that it is investigating several incidents involving refrigeration systems in supermarkets across the country.
A store in the ICA chain reported through social networks that the temperature of its refrigerators and freezers was modified during the night and adjusted to 50 °C. Later, the establishment was able to reopen its doors.
At another supermarket in the chain, ICA Baronen, in Stockholm, a notice to customers stated that all freezers had been out of service due to a cyber attack. According to establishment officials, the incident occurred around 2:00 a.m. and was detected shortly after 5:30 a.m.
ICA confirmed that a limited number of stores were affected by an overnight incident which directly impacted their refrigeration and freezing systems.
Likewise, the distribution group Coop reported that six of its establishments suffered incidents with similar characteristics.
John Billow, head of the Swedish National Cybersecurity Center, noted that in recent weeks a significant number of operational technology devices have been identified as exposed to security risks, reiterating the need to keep them updated and properly patched.
Estonia, also affected
The problems were not limited to Belgium and Sweden. As technology provider Kitman Coldtech told the public broadcaster ERR, a supermarket chain in Estonia also suffered an attack that changed the temperature settings of its refrigeration systems to 50 °C.
The company's CEO, Jann Mutso, described the incident as "very recent" and confirmed that it occurred the same morning, although he declined to identify the affected chain.
Although at the moment no organization has claimed responsibility for these attacks and the authorities have not publicly identified those responsible, the repetition of similar incidents in several European countries points to a possible coordinated campaign against commercial refrigeration infrastructure connected to the internet.
The events once again put the focus on the cybersecurity of industrial systems and operational technology, an increasingly critical area for essential sectors such as food distribution.
