European supermarket freezers hit just weeks after French cyber attack

Freezers at dozens of supermarkets in Sweden and Belgium have suddenly overheated in a suspected cyber attack, ruining food worth millions of euros just weeks after French retailers were targeted.

Freezers at Ica and Coop shops in Sweden were turned up to as high as 55C on Monday while supermarkets belonging to Ahold Delhaize and Carrefour were affected in Belgium.

The incidents come weeks after hundreds of French supermarkets suffered similar attacks, with the temperature in one fridge rising to 80C.

About 40 Delhaize shops in Belgium and five Spar stores were affected, according to local media reports, while Carrefour said 15 of its outlets in Flanders and Wallonia had been hit but remained open.

Coop in Sweden said that unidentified hackers had been able to tamper with fridges and freezers at seven of its roughly 800 stores.

Camilla Nilsson, store manager of Ica St Olof in Österlen in Sweden, said that hackers had “managed to get into our refrigeration management systems and change the settings”. At least four of Ica’s shops were hit.

Experts have repeatedly warned of the damage cyber attacks could inflict on critical infrastructure, from power plants to food shops, due to poor IT security and outdated software.

“We can’t adjust the temperatures, we can’t change them. Hot air is blowing into the freezers. Everything is ruined,” Rickard Nilsson, head of an Ica shop in Sjöbo in southern Sweden, told newspaper Aftonbladet.

Temperatures of more than 50C had destroyed food worth hundreds of thousands of Swedish krona, he added.

Last month’s attacks in France are being investigated by the cyber crime unit of the Paris public prosecutor’s office as well as Anssi, the French government’s cyber security agency.

Many of the affected fridges and freezers were running software by Danfoss, the large, privately owned Danish industrial group. Researchers at cyber security company Claroty said in a report in August that they had “identified multiple vulnerabilities” in Danfoss’s systems, which the Danish group subsequently fixed.

Danfoss said last month that the cyber attacks affected fridge systems that were no longer receiving security updates and were running on outdated firmware. The Danish company said no link had been established between Monday’s attacks and its products.

Mich Vergauwen, spokesperson for Carrefour in Belgium, said Monday’s attack was similar to the one in France and that only a small number of its stores had been affected because of additional measures taken after the French incidents, including updates and using a secure connection.

Attacks on industrial hardware, known in the cyber security industry as operational technology or OT, have traditionally required highly specialised knowledge and been difficult to execute at scale.

Robert Lee, chief executive of cyber security company Dragos and a leading expert on OT attacks, said large language models had made it easier for hackers to access the expertise and tools needed to hit multiple devices and sites at the same time.

Earlier this year, suspected Iranian hackers targeted dozens of water utilities in the US, locking administrators out of their systems and forcing shutdowns.

“The reach and scale of these attacks is new,” he said, noting that OT attacks used to be one-off incidents. “We’ve never had a hundred-plus water utilities [being affected] at once. We’ve never had hundreds of supermarkets at once.”

Ahold said it was aware of “an IT incident affecting the refrigeration systems in a number of Delhaize stores” and was working to assess the situation.

Additional reporting by Laura Dubois in Brussels and Aaron Kirchfeld in London