Delhaize

Summary

A cyber-attack targeting refrigeration systems affected dozens of supermarkets across seven European countries, including around 40 Delhaize stores in Belgium and Luxembourg, with additional impacts on Carrefour, Colruyt, Ikea, ICA, Coop, SuperValu, and other retailers in Sweden, Ireland, the Netherlands, Estonia, and Finland. The attack switched evaporators to defrost mode, causing freezer temperatures to rise as high as 50 degrees Celsius and forcing stores to discard spoiled food, with one Belgian branch reporting losses of approximately 100,000 euros. National cyber-security agencies in Belgium and Sweden monitored the incident while authorities investigated potential links to similar attacks on French supermarkets and American military bases.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Dozens of supermarkets across seven European countries were struck by a cyber-attack that targeted refrigerators and freezers, with around 40 Delhaize supermarkets in Belgium and Luxembourg among the affected locations. A smaller number of shops were also hit in Sweden, Ireland, the Netherlands, Estonia, and Finland. Sabcobel, the Belgian company that manufactures some of the affected refrigeration units, reported that the units' evaporators were switched to defrost mode, causing them to warm up, in what is believed to be the same method used in an earlier incident that struck hundreds of French supermarkets in early October. Local media reported at the time that millions of euros worth of food had to be thrown away during that October event. Stephan Moelans, the chief executive of Sabcobel, which operates Delhaize's systems, told the Belga news agency that the incident was a cyber-attack and that the company had been working through the night and morning to disconnect the affected units from the network. Moelans stated that since the French attack in early October, the company had been working to protect customers' refrigerators against the vulnerability, but that the units required physical modifications rather than software updates alone. He noted that most supermarkets across Europe are linked to the internet and that maintenance and troubleshooting can be performed remotely, adding that the simplest solution is to manage the fridges over a secure internet connection and that most customers had switched to that arrangement after the attack in France. The temperature of freezers in several shops across Europe reportedly rose to as high as 50 degrees Celsius, or 122 degrees Fahrenheit. It remains unclear who is behind the latest apparent attack.

The impacts and responses extended across multiple retailers and national authorities. In Flanders, northern Belgium, a Delhaize branch in Hoeilaart told news website Het Laatste Nieuws that it had lost 100,000 euros worth of produce, with the manager noting that the estimate did not account for further losses resulting from closing the shop. Carrefour, a French-owned supermarket chain, said the incident had affected 15 of its Belgian stores and that measures had been taken immediately to ensure all shops remained open. A spokesperson for Colruyt Group, which operates Spar stores in Belgium under a franchise system, told Reuters that five shops had their fridge systems attacked. Ikea reported that the refrigeration systems of its store in the western Belgian city of Mons were affected, with a spokesman quoted by Reuters as saying that additional locations could not be ruled out. In Sweden, several ICA and Coop shops were hit, and an ICA spokesperson confirmed that the incident had affected a small number of ICA stores operating outside ICA's central network, adding that ICA was supporting the affected stores in managing the situation. One ICA branch in Sjöbo, southern Sweden, wrote on social media that its refrigerators and freezers had been hacked overnight and set to 50 degrees, noting that the store had closed earlier but had since reopened to customers. Seven out of the 800 Coop stores in Sweden were also affected, though the company said the situation was contained and under control. In Finland, refrigerator malfunctions were detected in some K-stores, and the owner of the Kesko supermarket chain was quoted by Helsingin Sanomat as saying its security experts were investigating the cause. In Ireland, the incident impacted 13 SuperValu supermarkets, and a spokesman for Musgrave Group confirmed to The Irish Times that a cyber incident affected its refrigeration systems but was limited to a specific model. A spokesperson for Danish manufacturer Danfoss told Dutch public radio channel NOS that the freezing and cooling systems of at least 17 companies in the Netherlands were attacked overnight, affecting butchers' shops and small neighbourhood stores. A Selver supermarket in Estonia was also affected, with reports of other affected companies in the country according to ERR. Beyond the retail sector, authorities in the United States are investigating what caused refrigeration malfunctions at a number of American military bases in August and are working with French officials to examine whether those incidents could be linked. Both Belgium's and Sweden's national cyber-security agencies said they were monitoring the incident, while the United Kingdom's National Cyber Security Centre said it was working with international partners and industry to fully understand details of the incident, noting that no incidents have been reported in the UK.

Sources

Sources available to members: 1 source.