A suspected cyberattack hit grocery stores across at least nine European countries on Monday 2 November, prompting the EU to warn of a deliberate attempt to disrupt the bloc’s food supply chain.
Supermarkets in Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal, and Sweden reported refrigeration problems that forced some retailers to discard food after temperatures rose overnight.
The incident comes three weeks after a cyberattack disrupted French grocery stores and forced hundreds of outlets to throw away spoiled stock.
No one has claimed responsibility for either incident.
European Commissioner for Agriculture and Food Christophe Hansen said the bloc was taking the incidents “very seriously”.
“They are a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it — a warning that we must take seriously,” he said.
Italy
In Italy, at least four Coop supermarkets in Sicily and one business in Tuscany were affected, according to media reports and the national cybersecurity agency.
The Italian government was to hold a cybersecurity meeting with intelligence services on Tuesday.
“The attack happened at 4:00 am,” Giuseppe Spadaro, head of the Radenza Group, which manages Coop-branded supermarkets, told Italian news agency ANSA.
The attack targeted “our remote-control system for frozen food sections” and had since been resolved, he added.
Belgium
Belgium was among the hardest-hit countries, with dozens of stores across several grocery chains reporting refrigeration failures. Federal prosecutors opened an investigation.
“It’s a cyberattack, there is no other reason,” said Mich Vergauwen, a spokesman for Carrefour Belgium, which reported disruption in about 15 of its 700 stores.
Ikea said its Mons outlet also experienced a cyberattack that caused freezer temperatures to rise.
Belgian refrigeration company Sabcobel said it had begun securing its installations after the October attack in France, but some systems had yet to be upgraded and were among those affected on Monday.
Delhaize, Colruyt and Intermarché also reported refrigeration problems at stores in Belgium, while four Delhaize outlets in Luxembourg were affected.
Ireland
In Ireland, retailer Musgrave said 13 Supervalu stores were impacted by what it described as a cyber incident.
A small number of corner shops in the Netherlands also suffered disruptions.
Portugal
In Portugal, the Mosqueteiros group confirmed to AFP incidents at seven Intermarché stores linked to a cyberattack, which “appears to have targeted an external service provider responsible for managing the refrigeration systems”.
Sweden
In Sweden, Coop confirmed six of its around 800 stores had been hit.
“We can confirm that it is a cyber incident. The problem has now been resolved and the fridges and freezers are working as normal,” spokesman Carlos Cancino told AFP.
He said Coop did not know who was behind the attack, but noted that the affected stores had been connected to a 4G mobile network, not the updated 5G system, which made them “more exposed” to hackers.
Swedish chain Ica also said “a limited number” of its stores experienced refrigeration problems, without confirming a cyberattack.
According to Ica spokesperson Helena Johansson, the affected stores were all connected to an external refrigeration control system provided by Danish manufacturer Danfoss, the same supplier targeted in the October 12 cyberattack on French retailers.
She referred all queries to Danfoss, which had yet to respond to an AFP request for a comment.
Finland
In Finland, irregular temperatures were also detected in a few smaller grocery stores belonging to the Kesko group.
“We are currently investigating the cause, and interference via the network has not yet been ruled out,” Petri Kayhko, head of Kesko’s corporate security, told AFP.
Roni Kokkola, an information security specialist at the National Cyber Security Centre at Finland’s Transport and Communications Agency Traficom, would not rule out cyber interference.
“We’ve seen this in Europe in the past few months, so it spreading beyond France to other countries has been expected,” he told AFP.
“Nowadays, it’s very typical that all kinds of vulnerabilities are being exploited ever more actively and rapidly.”
Estonia
In Estonia, at least one supermarket was attacked by hackers who raised the temperature in the refrigeration units to 50C, public broadcaster ERR reported.
The units were older models delivered by Danfoss, similar to the ones targeted in the France attack, Jann Mutso, director of Kitman Coldtech, a manufacturer and distributor of advanced refrigeration systems, told ERR.
Paolo Falcioni, Director General of the European home appliances association APPLiA, told Euronews, “In a supermarket, cyber resilience has a practical test. If remote access is disrupted, can staff still check temperatures and act to protect the cold chain? Manufacturers and retailers both have a role in making sure the answer is yes.”
“APPLiA supports a common European framework for the cybersecurity of connected products. Security starts at the design stage and continues throughout the product’s life, with security updates and a clear process for dealing with vulnerabilities.”
“As Europe implements the Cyber Resilience Act, we need practical standards that reflect how products are used and what can happen if they are compromised,” he added.