Hackers hit European supermarket fridges again, and Brussels convenes a task force

A spokesperson confirmed to CNBC that the EU Commission convened an interinstitutional task force with ENISA and Europol on 3 November to examine the refrigeration attacks. The Commission said it was in direct contact with national authorities.

Shoppers face an immediate risk of empty shelves and discarded stock. Retailers face a weak point: the internet-connected controller that keeps a cold room cold, often legacy kit on default passwords. No one had claimed the attacks by Monday night.

The attacks have not directly affected any UK grocery chain so far. Retailers in Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands and Sweden reported refrigeration problems on Monday. Some temperatures reached 50C.

Store-by-store damage

Ahold Delhaize said dozens of its Delhaize stores in Belgium and Luxembourg had a refrigeration incident on Monday and food had to be discarded. It said stores were fully operational again. Colruyt Group said five of its Spar stores in Belgium came under attack. Carrefour told the BBC that 15 of its Belgian stores suffered attacks. Intermarché said attacks hit 15 of its 153 Belgian stores, with a few suffering stock losses, though nothing comparable to the mid-October attack.

In October, attacks targeted hundreds of French supermarkets. Intermarché owner Les Mousquetaires said it expected damages of several million euros.

IKEA said a cyber incident hit fridges and freezers at its Mons store in Belgium over the weekend. The store stayed open while the company inspected equipment and products. It called the impact on its restaurant and Swedish Food Market limited.

ICA, Sweden's biggest grocery retailer, confirmed an incident at a limited number of stores. Those stores sit on networks outside ICA's central systems. Finnish Kesko, Irish grocery chain Supervalu and Estonian grocer One Selver also reported disruptions, CNBC reported.

Default passwords and legacy kit

The attack on French supermarket fridges last month involved legacy technology connected to the internet with default passwords, the Guardian reported. The NCSC said the fridge attacks were not AI-enabled. It said they used vulnerabilities that had been out there for a long period of time. Ollie Whitehouse, the NCSC's chief technology officer, said manufacturers needed encouragement to make their technology safer.

Alex Pearce, managing director of Langridge Organic, said hackers changed parameters on a number of units, setting them to defrost for more than four hours. Staff intervened before stock suffered damage.

"It clearly must have been easy to get in [to the system] because the simple solution was to unplug ourselves from the internet," Pearce said.

Pearce said Langridge uses the same fridge control system that US software company Copeland developed and that featured in the French attacks. The British Association of Independent Meat Suppliers said the hack affected some of its more than 300 members as collateral. The industry body said the refrigeration hacks caused no meat losses. One meat supply company saw its cold units rise while another two reported their units had started to defrost. The association said the affected units were empty at the time.

The association said the incidents showed that food businesses at any point in the supply chain can become targets.

What is still unknown

Paul Chichester, the NCSC's director of operations, said the agency was not able to comment on who might have carried out the attacks. He said the NCSC would keep monitoring.