Intermarché

Summary

A cyberattack targeting an external refrigeration management provider disrupted operations at seven Intermarché stores in Portugal, contributing to a wider wave of incidents across at least ten European countries that caused supermarket freezer temperatures to spike as high as 50 degrees Celsius and forced retailers to discard spoiled food. The broader campaign, which also affected chains in Belgium, Ireland, Italy, and other nations, resulted in food losses estimated in the tens of millions of euros and prompted European Union officials to warn of deliberate attempts to disrupt the food supply chain.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Mosqueteiros group reported that incidents at seven Intermarché stores in Portugal had been linked to a cyberattack, which appeared to have targeted an external service provider responsible for managing the refrigeration systems. The Intermarché disruptions were part of a spate of cyberattacks that hit supermarket chains across at least 10 European countries on Monday, prompting European Union officials to warn of a deliberate attempt to disrupt the food supply chain. The affected countries included Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Germany, and Sweden. The attacks occurred three weeks after a cyberattack disrupted as many as 700 French grocery stores, causing food losses estimated at tens of millions of euros. No one had admitted carrying out the cyberattacks. The security of refrigeration systems as well as other devices that can be monitored remotely heightened concerns about government-backed hybrid attacks. The EU's food and agriculture commissioner, Christophe Hansen, said the bloc was taking the incidents very seriously and warned of further disruption in the future. Commission spokesman Thomas Regnier said the incidents showed how cyberattacks can disrupt essential services and affect citizens' daily lives, adding that they were not isolated incidents and that collective resilience and preparedness were necessary.

Temperatures in chains across Europe reportedly rose as high as 50C (122F), and the significant increase in freezer temperatures forced retailers to discard food. In Belgium, dozens of stores reported refrigeration failures, and federal prosecutors opened an investigation. In Ireland, 13 SuperValu stores were impacted by what the chain's owner, Musgrave Group, called a cyber-incident, with replenishment of chilled and frozen ranges in the affected stores under way. In Estonia, at least one supermarket was attacked by hackers who raised the temperature in the refrigeration units to 50C. In Germany, disruption to refrigeration systems at the Rewe Büsken supermarket in western Germany followed a cyberattack on system provider Danfoss, with systems back in operation since Monday afternoon. In Sweden, ICA said a limited number of its stores had experienced refrigeration problems, while Sweden's national cyber-security agencies monitored the incident. In Finland, irregular temperatures were detected in a few smaller grocery stores belonging to the Kesko group, which said it was investigating the issue. Food losses across the affected region were estimated in the tens of millions of euros.

Investigations began in several European countries in response to the cyberattacks. The UK's National Cyber Security Centre warned British retailers to update the software on fridge temperature controls. The agency said the country was likely to suffer an AI-powered cyberattack on critical national infrastructure within two years. Richard Horne, the head of the National Cyber Security Centre, said there were a couple of instances in the UK where vulnerable technology had been exploited after the cyberattacks, and that the issue extended through the whole food supply chain. Italy's government called a meeting with intelligence chiefs but said the impact was currently very limited and that most of the food distribution chain had up-to-date security systems able to fend off such attacks. Meloni's office said businesses affected in Italy were mostly still equipped with obsolete security systems, with interfaces directly exposed to the internet and inadequate authentication mechanisms. In the Netherlands, a small number of corner shops suffered disruption, and last month supermarket chain Albert Heijn had to take several services offline because of a separate cyberattack.

Sources

Sources available to members: 1 source.