European retailers face coordinated cyber-attacks on refrigeration systems

European Union officials have issued a warning regarding a coordinated series of cyber-attacks that disrupted supermarket operations across at least ten countries this Monday. The incidents targeted the refrigeration systems of major grocery chains, causing temperatures to spike significantly and forcing retailers to discard large quantities of perishable goods. The attacks have heightened concerns within the bloc about the vulnerability of the food supply chain to deliberate digital interference.

The disruption affected supermarket chains in Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Germany, and Sweden. Reports indicate that freezer temperatures in some locations rose as high as 50C, or 122F. While no single entity has publicly admitted responsibility for the attacks, the timing and scope have led officials to view the events as a strategic attempt to strain essential services.

The European Union’s food and agriculture commissioner, Christophe Hansen, stated that the bloc is treating the incidents with great seriousness. He warned that further disruptions are possible in the future. Commission spokesman Thomas Regnier noted that these events highlight how cyber-attacks can interfere with daily life for citizens. He emphasized that these are not isolated incidents and that collective resilience and preparedness are necessary to handle such threats.

In Italy, the government convened a meeting with intelligence chiefs to assess the situation. While officials described the overall impact as currently very limited, they noted that most of the food distribution chain possesses up-to-date security systems. The national cybersecurity agency reported that at least four Co-op supermarkets in Sicily and one business in Tuscany were affected. The prime minister’s office indicated that the impacted businesses were mostly using obsolete security systems with interfaces directly exposed to the internet and inadequate authentication mechanisms.

Belgian retailers were among those most severely affected, with dozens of stores reporting refrigeration failures. Federal prosecutors in Belgium have opened an investigation into the incident. Mathieu Tilman, a manager at a Delhaize supermarket in Belgium, expressed shock at the scale of the disruption. He described the situation as truly distressing, questioning how so much food could be thrown away and admitting that in moments like these, he felt like quitting his job.

In Ireland, the Musgrave Group confirmed that thirteen SuperValu stores were impacted by what it termed a cyber-incident. A company spokesman stated that the replenishment of chilled and frozen ranges in the affected locations is well under way. Meanwhile, in the Netherlands, a small number of corner shops suffered disruption. This follows a separate incident last month where supermarket chain Albert Heijn had to take several services offline due to a different cyber-attack.

Disruption was also reported in western Germany, where refrigeration systems at a Rewe Büsken supermarket were affected by a cyber-attack on system provider Danfoss. The company informed the BBC that its systems returned to operation by Monday afternoon. In Portugal, the Mosqueteiros group linked incidents at seven Intermarché stores to a cyberattack that appears to have targeted an external service provider responsible for managing refrigeration systems.

Other nations have also monitored the situation. Swedish chain ICA reported that a limited number of its stores experienced refrigeration problems, though it did not confirm a cyber-attack, while national cyber-security agencies in Sweden stated they are monitoring the incident. In Finland, the Kesko group detected irregular temperatures in a few smaller grocery stores and is investigating the issue. In Estonia, public broadcaster ERR reported that at least one supermarket was attacked by hackers who raised refrigeration unit temperatures to 50C.

In the United Kingdom, the National Cyber Security Centre has warned British retailers to update the software on fridge temperature controls. The agency stated that the country is likely to suffer an AI-powered cyber-attack on critical national infrastructure within two years. Richard Horne, the head of the NCSC, told BBC Radio 4 that there were a couple of instances in the UK where vulnerable technology had been exploited following the attacks. He noted that while the full impact is not yet known, the team is working with affected organizations and alerting those with exposed technology throughout the food supply chain.