Shop & Go

Summary

Shop & Go convenience shops attached to Q8 service stations were among dozens of retail locations across several European countries whose refrigeration and freezer units were compromised in a suspected cyber-attack, with attackers switching evaporators to defrost mode and driving temperatures as high as 50C. Technicians were mobilized in the early hours to disconnect affected installations, while retailers removed chilled and frozen products from sale and faced potential food losses amid widespread disruption to grocery supply chains.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Supermarket chains in at least seven European countries reported that temperatures in refrigerators and freezers in some of their shops rose overnight to as high as 50 degrees Celsius, or 122 degrees Fahrenheit. The affected countries included Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands, and Sweden. Several companies confirmed they had been hacked in an incident echoing a cyber-attack the previous month in France that caused millions of euros of damage. In Belgium, Le Soir newspaper reported that dozens of shops and supermarkets were affected, including five Spar outlets, Shop & Go convenience shops attached to Q8 service stations, and some smaller Proxy Delhaize mini-markets. The Dutch retailer Ahold Delhaize said fridges and freezers in dozens of its supermarkets in Belgium and Luxembourg had been hit. The Colruyt and Intermarché supermarket chains reported technical problems affecting fridges in five and 15 of their shops respectively, while Carrefour Belgium reported disruption in about 15 of its 700 shops. In Sweden, the Coop chain said six of its shops had been hit, and ICA said a limited number of stores were affected by an incident overnight that impacted refrigeration and freezer systems. An ICA shop at Sjöbo in southern Sweden posted that its fridges and freezers had been hacked and their temperature set at 50 degrees Celsius. Another ICA shop in Stockholm said its freezers were broken due to a 2am cyberattack and that everything was destroyed. Ikea Belgium reported that a cyber-attack caused the temperature of freezers in its Mons shop to rise suddenly, forcing the removal of some food products from refrigeration units as a precaution.

In Finland, shops operated by the Kesko supermarket chain investigated similar problems, while Dutch public radio NOS reported that systems of at least 17 mainly small local shops had been affected. At one Estonian supermarket chain, attackers accessed a computer controlling the refrigeration system and turned the temperature up to 50 degrees Celsius, and the Selver supermarket chain said one of its outlets had been affected. Ireland's SuperValu chain said refrigeration systems limited to a specific model in 13 of its 223 shops had been affected by a cyber-incident, and chilled and frozen products were removed from sale. Stephan Moelans, chief executive of Sabcobel, which operates Delhaize's refrigeration systems, told Le Soir that technicians began mobilising at 1am and spent all night and morning disconnecting the affected installations. Moelans told the Belga news agency that the incident had been a cyber-attack and that the units' evaporators were switched to defrost mode. Ahold Delhaize spokesperson Sarah De Meester said the range of fresh and frozen products was temporarily somewhat limited in affected shops, but distribution centres were operating normally and there was no disruption to deliveries. Kitman Coldtech, the refrigeration supply company in Estonia, said the attack was responded to within minutes and there had been no significant damage. The head of Sweden's national cybersecurity centre, John Billow, said the centre was working on incidents around the country and noted that Sweden had quite a lot of exposed operational technology devices that needed updating or patching. In France, the prosecutor's office opened a formal investigation into the prior month's attack, and the prime minister instructed the national cybersecurity agency Ansii to investigate. Ansii subsequently reported that supermarkets using controllers from two other companies had also been targeted, though authorities have not indicated who could have been behind the incidents and there have been no claims of responsibility.

Sources

Sources available to members: 1 source.