Second wave of fridge hacks hits European supermarkets as Brussels convenes task force

A second wave hits European supermarkets

On Monday 2 November, supermarkets in Ireland, Sweden, Estonia and Belgium reported fridges and freezers being hiked in temperature.

For retailers the exposure is stock, not data. A remote change to a cooling setpoint can spoil food worth hundreds of thousands of euros in a single store.

Ahold Delhaize told CNBC that dozens of its Delhaize stores in Belgium and Luxembourg had refrigeration problems and threw food away. Colruyt Group said five Spar stores in Belgium were targeted. Carrefour said 15 of its Belgian stores were attacked, and Intermarché said 15 of its 153 Belgian stores were impacted. IKEA said a cyber incident affected refrigerators and freezers at its Mons store in Belgium between Sunday and Monday. Some stores reported temperatures as high as 50C (122F). The incidents followed attacks on supermarkets and food suppliers across France in early October.

ICA, Sweden's largest grocery retailer, said a limited number of stores on networks outside its central systems were affected. Finnish grocer Kesko, Irish chain Supervalu and Estonian retailer One Selver also reported disruptions to their refrigeration systems.

Why food loss matters

The October wave in France was larger. Hundreds of French supermarkets were targeted, spoiling fresh and frozen food estimated to be worth millions of euros.

Intermarché owner Les Mousquetaires told CNBC at the time that it expected damages of several million euros. The damage reached the UK supply chain too. The British Association of Independent Meat Suppliers has more than 300 members. Two of them saw fridges begin to defrost and another saw cold units rise to up to 100C, the association said. AIMS said the affected devices were empty at the time, so no produce was lost. At Langridge Organic, a London fruit and vegetable wholesaler, staff pulled the internet connection to stop the attack.

UK fallout and official response

The NCSC said it was aware of "a couple of instances where vulnerable technology had been exploited in the UK".

Its chief executive, Richard Horne, told BBC Radio Four that the agency had worked through the night to alert potentially affected organisations. Paul Chichester, the NCSC's director of operations, said the UK impact was minimal and that no UK grocery chain had been directly affected so far. Speaking at the launch of the NCSC's annual review on Tuesday, he said the agency would keep monitoring the situation. Chichester said the attacks were not AI-enabled and used vulnerabilities that had been "out there for a long period of time".

Legacy controls and what comes next

The French attack involved legacy technology connected to the internet with default passwords, the Guardian reported.

The hacks exploited vulnerabilities in systems used to remotely control and manage cold refrigeration units that cyber-security researchers had surfaced months earlier. Sabcobel, a Belgian refrigeration contractor that manages systems for Delhaize, said the units were switched to defrost mode. Horne said many firms had extended systems beyond their end of life, failed to upgrade them and left them connected to the internet. He said the technology base society relies on "has not been invested on to the extent it needs to be". Horne described the fridge attacks as the "foothills" of a larger cyberthreat, as AI systems expose flaws owners have not patched.

Horne said it was still too early to say who was behind the hacks.