IKEA

Summary

A cyberattack targeting refrigeration and freezer systems affected supermarket groups and retailers across Europe, including one IKEA store in Belgium, with other locations potentially facing disruptions. The intrusion raised temperatures in cooling units, forcing stores to discard spoiled food and causing financial losses, while authorities noted the incident as part of a broader pattern of hybrid threats to infrastructure without identifying the perpetrators.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

A cyberattack targeting refrigeration and freezer systems spread across European supermarkets on Monday, affecting stores from Sweden to Belgium and forcing retailers to discard spoiled food. The incident struck supermarket groups including Ahold Delhaize and Colruyt in Belgium and Luxembourg, as well as Swedish grocers ICA and Coop. Furniture retailer IKEA confirmed that one of its stores in Belgium had been impacted by the cyber incident. IKEA stated that it could not rule out disruptions at other locations. The attack raised temperatures in refrigerator and freezer units at dozens of stores, disrupting cold-chain operations across multiple national borders. Some of the affected refrigerator units relied on temperature-control technology supplied by Danish firm Danfoss, which had also been targeted during a similar attack in France the previous month. The intrusion was reported as occurring at 2 a.m. local time, though affected operators did not notice the issue until hours later.

At an ICA franchise store in Stockholm, freezers reached 50 degrees Celsius, leading a sales manager to report that everything in the affected units was destroyed. The broader incident forced stores across the region to throw away food as refrigeration temperatures rose. A Belgian butchery owner reported that fridges at his location south of Antwerp were turned up to as high as 18 degrees Celsius, ruining approximately 15,000 euros worth of meat. Carrefour reported that 15 of its 700 stores in Belgium were affected during the prior French attack, while Coop said 7 of its 800 stores experienced unauthorized tampering with refrigeration systems. The previous month's attack in France had seen hackers seize control of cooling units at hundreds of supermarkets, causing fires and food losses, and Ahold had separately reported a cybersecurity incident to police during that period. No group claimed responsibility for the Monday attacks, and investigators could not establish whether they were linked to the incidents in France.

Belgium's Centre for Cybersecurity stated that it was not known who was behind the attack and that responsibility might never be determined. A spokesperson for the centre expressed concern about the growing number of incidents and noted that artificial intelligence could be used to exploit vulnerabilities in IT systems, particularly by sophisticated actors. Danfoss said it had been working with customers to implement fixes for the temperature-control technology implicated in the breaches. Russian authorities denied involvement in sabotage or hybrid warfare operations, though European authorities have voiced heightened concern about threats to infrastructure amid security tensions following Russia's 2022 invasion of Ukraine. One affected business owner said he had contacted police but did not know whether an investigation had been launched.

Sources

Sources available to members: 1 source.