ICA Kvantum

Summary

A Swedish ICA Kvantum store in Sjöbo reported that hackers compromised its refrigeration and freezing systems, raising temperatures to 50 degrees Celsius and forcing staff to discard spoiled goods. The incident was part of a broader wave of cyberattacks targeting supermarket refrigeration across several European countries, including Belgium, Luxembourg, Ireland, and Estonia, where chains such as Coop, Delhaize, Carrefour, SuperValu, and Selver experienced disrupted cooling, product removals, or limited fresh and frozen availability. In France, similar attacks previously compromised hundreds of supermarket and independent store cooling systems, apparently focusing on older technology, while affected retailers elsewhere worked to restore operations and replenish chilled and frozen ranges.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On Monday, supermarkets across Sweden, Belgium, Luxembourg, Ireland, and Estonia experienced problems with freezers and fridges that were apparently caused by cyberattacks, forcing some retailers to dispose of ruined food. The issues followed an incident the previous month in which attackers remotely took control of refrigeration systems in hundreds of supermarkets and independent stores across France, sending temperatures soaring. Gustaf Nilsson, a spokesperson for Sweden's ICA Group supermarket chain, told the TT news agency that a limited number of stores were affected overnight by an incident involving refrigeration and freezing systems, though he declined to provide a specific number. An ICA Kvantum store in Sjöbo, southern Sweden, reported that its fridges and freezers had been hacked and set to 50 degrees Celsius, equivalent to 122 degrees Fahrenheit. In a Facebook post, the store stated that staff were discarding affected products. The Coop chain separately reported that six of its stores in central Sweden had problems with their fridges and freezers, though it did not immediately have further details.

In Belgium, the Delhaize chain said an IT incident had affected refrigeration systems in several dozen of its stores, mostly in Belgium but also a few in neighboring Luxembourg, with the range of fresh and frozen products temporarily limited while distribution centers continued operating normally and deliveries to stores remained undisrupted. Carrefour reported that a cyberattack targeting refrigeration systems had affected 15 of its more than 700 stores in Belgium, describing the impact as extremely limited. In Estonia, Kitman Coldtech, a refrigeration technology company, said attackers had accessed a computer controlling a client's refrigeration system and raised the temperature to 50 degrees Celsius; chief executive Jann Mutso declined to identify the store but said the attack was addressed within minutes and caused no significant damage, while the Selver supermarket chain said one of its outlets was affected. In Ireland, refrigeration systems in 13 SuperValu stores were affected by a cyber incident, according to parent company Musgrave Group, which said chilled and frozen products were removed from sale as a precaution. On Monday afternoon, Musgrave Group stated that the incident had been fully resolved and that replenishment of chilled and frozen ranges in the affected stores was well under way. The cyberattacks in France appeared to target old systems.

Sources

Sources available to members: 1 source.