Carrefour

Summary

A wave of cyberattacks targeting refrigeration systems disrupted supermarkets across several European countries, including Belgium and Sweden. Carrefour acknowledged that 15 of its more than 700 stores in Belgium were affected, with no hypermarkets experiencing disruption and the impact described as extremely limited. Other retailers reported similar issues, with some stores facing completely shut-down refrigerators and freezers while others had partially functioning units or equipment generating heat. The identity of those responsible remains unknown.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

A fresh wave of cyberattacks targeting refrigeration systems disrupted supermarkets across Europe, with breaches reported in countries including Sweden, Belgium, and Luxembourg. The incidents bore resemblance to a similar attack that had affected hundreds of French supermarkets the previous month. Carrefour issued a statement acknowledging the breach at its stores in Belgium, characterizing the impact as extremely limited. The French retail giant confirmed that 15 of its more than 700 stores in Belgium were hit by the attacks. Carrefour specified that none of its hypermarkets experienced disruption as a result of the incidents. The broader wave of cyberattacks also affected other major retailers in the region, including Delhaize in Belgium and Coop in Sweden. A Delhaize spokesperson, part of the Netherlands-based Ahold Delhaize group, said several dozen of its stores were hit. In the affected Delhaize stores, the range of fresh and frozen products was temporarily somewhat limited. The spokesperson noted that distribution centers were operating normally and there had been no disruption to deliveries to stores. In Sweden, a spokesperson for Coop said seven of its more than 800 stores were affected, adding that the situation was contained and under control. Colruyt Group, which operates Spar stores in Belgium under a franchise model, saw five of its shops experiencing attacks on their refrigeration systems. Fellow Swedish retailer ICA also reported an incident at a limited number of stores that use an external supplier, but said its central systems were not affected. The identity of those behind the latest apparent attacks remained unknown.

The attacks on Carrefour's Belgian stores involved refrigeration systems, consistent with the broader pattern of operational disruption observed across the affected retailers. Coop described that the issues ranged from completely shut-down refrigerators and freezers to partially functioning units, and in one case the system began to generate heat. Carrefour's statement confirmed that the scope of the intrusion was confined to a small fraction of its Belgian store network, representing 15 locations out of more than 700. The company did not report disruption to its hypermarket operations or to its broader supply chain. The incidents were reported on 2 November, with statements from affected retailers issued just before 17:00 CET that day. No further details about the specific attack vector, the identity of the perpetrators, or particular remediation steps taken by Carrefour were provided in the reporting. The French retail giant's acknowledgment came as part of a wider series of disclosures from European grocery operators facing similar interference with refrigeration infrastructure.

Sources

Sources available to members: 4 sources.