Musgrave Group

Summary

A cyber incident affecting refrigeration systems in 13 SuperValu stores operated by food wholesaler Musgrave forced the removal of some chilled and frozen products from sale after monitoring systems detected the issue. The company stated that its investigation was ongoing and that immediate action had been taken, with the disruption occurring as part of a wider European wave of attacks on supermarket cooling units that caused temperature spikes and spoiled food.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In Ireland, food wholesaler Musgrave reported that a cyber incident had affected refrigeration systems in 13 of its SuperValu stores, forcing the company to remove some chilled and frozen products from sale. The company stated that its monitoring systems alerted it to the issue and that it took immediate action in response. Musgrave also said that its investigation into the incident was ongoing. The company did not immediately respond to a request for comment from NBC News. The Musgrave incident was part of a broader wave of apparent cyberattacks that hit supermarkets across Europe on Monday, affecting stores in Sweden, the Netherlands, Belgium, Ireland, Luxembourg, and Estonia. The incidents caused temperature spikes and spoiled food at the affected locations. The wave followed a cyberattack in France the previous month in which police said hackers seized control of cooling units at hundreds of supermarkets, raising temperatures as high as 122 degrees Fahrenheit and causing fires and food losses. Authorities had not indicated who could have been behind the incidents, and there were no claims of responsibility. The issues emerged as the continent confronted broader security fears stemming from Russia’s war in Ukraine.

Other retailers reported similar disruptions during the same period. The Ahold Delhaize supermarket chain in the Netherlands said it was aware of an IT incident affecting refrigeration systems in a number of its stores and that its teams were working to assess the situation. Stephan Moelans, CEO of Belgian refrigeration company Sabcobel, which operates Delhaize’s systems, told the Belga news agency that the incident was a cyberattack in which the units’ evaporators were switched to defrost mode. A spokesperson for Colruyt Group, which operates Spar stores in Belgium under a franchise system, said five shops had their fridge systems attacked. The Carrefour supermarket chain in Belgium said a cyberattack targeting refrigeration installations had an extremely limited impact, affecting 15 of its more than 700 stores. Sweden’s grocery retailer chain ICA told NBC News its systems were not affected but that it had been informed of an incident at a small number of stores that use an external supplier and have connectivity outside ICA’s central network. The ICA Kvantum branch in Sjöbo in southern Sweden wrote on its Facebook page that its fridges and freezers had been hacked and set to 122 degrees Fahrenheit and that it was working to discard the affected items. Privately held grocery retail group Coop told Swedish daily Aftonbladet that six of its stores had been affected by similar incidents. In Estonia, a company that makes the affected technology said that one of its clients had been hit by a cyberattack in which attackers accessed a computer controlling refrigeration and turned up the temperature to 122 degrees Fahrenheit. Sweden’s national cybersecurity center said it was working on several incidents affecting grocery stores across the country, and the head of the center, John Billow, said that in recent weeks they had identified quite a lot of exposed operational technology devices in Sweden that needed to be updated or patched.

Sources

Sources available to members: 3 sources.