Proxy Delhaize

Summary

A cyberattack targeting refrigeration systems disrupted supermarkets across multiple European countries, with temperatures in affected units rising to as high as 50°C. A Proxy Delhaize store in Belgium was among those hit, forcing staff to discard spoiled fresh and frozen products after an overnight incident. The broader chain reported that several dozen locations, primarily in Belgium with a few in neighboring Luxembourg, experienced cooling failures while distribution centers continued normal operations and deliveries remained uninterrupted. Other retailers, including ICA, Coop, Carrefour, and Ikea, also reported compromised refrigeration equipment, and similar attacks had previously affected hundreds of stores in France, causing significant food losses. No group has claimed responsibility for the incidents.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On Monday, refrigeration and freezing systems at supermarkets across several European countries experienced disruptions that were attributed to cyberattacks. In Belgium, a notice informed customers of an overnight attack on refrigeration systems at a Proxy Delhaize store in Maleizen, Overijse. A manager at that location disposed of fresh and frozen spoiled produce following the refrigeration outage. The Delhaize chain stated that an IT incident had affected refrigeration systems in several dozen of its stores, mostly in Belgium but also a few in neighboring Luxembourg. Reporters visiting a shop north-east of Brussels observed empty refrigerators and freezers with a sign stating that no products would be on the refrigerated or freezer shelves due to cyberattacks. Sarah De Meester, a company spokesperson, said the range of fresh and frozen products was temporarily somewhat limited in affected shops, while distribution centers continued operating normally and there was no disruption to deliveries. Belgium's Le Soir newspaper reported that dozens of shops and supermarkets had been affected, including five Spar outlets, Shop & Go convenience shops attached to Q8 service stations, and some smaller Proxy Delhaize mini-markets. Stephan Moelans, the chief executive of Sabcobel, which operates Delhaize's refrigeration systems, said technicians began mobilizing at 1 a.m. and spent the night and morning disconnecting affected installations. He described the incident as a cyber-attack in which the units' evaporators were switched to defrost mode.

The same night, supermarket chains in at least seven European countries reported that temperatures in refrigerators and freezers rose overnight to as high as 50 degrees Celsius. In Sweden, ICA said a limited number of stores were affected by an overnight incident impacting refrigeration and freezer systems, and an ICA shop at Sjöbo posted that its fridges and freezers had been hacked and set to 50 degrees Celsius. Another ICA location in Stockholm reported that its freezers were broken due to a 2 a.m. cyberattack and that everything was destroyed. The Coop chain said six of its shops in central Sweden had problems with fridges and freezers. In Estonia, the refrigeration supply company Kitman Coldtech said attackers accessed a computer controlling a refrigeration system and turned the temperature up to 50 degrees Celsius, though the attack was responded to within minutes and there was no significant damage. The Selver supermarket chain said one of its outlets was affected. Ireland's SuperValu chain said refrigeration systems limited to a specific model in 13 of its 223 shops were affected by a cyber-incident, and chilled and frozen products were removed from sale. In Finland, shops operated by the Kesko supermarket chain investigated similar problems, while Dutch public radio reported that systems of at least 17 mainly small local shops had been affected. Carrefour Belgium reported disruption in about 15 of its 700 shops, and Ikea Belgium said a cyber-attack caused the temperature of freezers in its Mons shop to rise suddenly, forcing the removal of some food products as a precaution.

The incidents echoed an attack from the previous month in France in which hackers seized control of cooling units in as many as 700 supermarkets, raising temperatures as high as 50 degrees Celsius and causing fires and food losses estimated in the tens of millions of euros. In that earlier attack, hackers remotely overrode settings on thousands of freezers, fridges, and chiller cabinets at chains including Intermarché, Coopérative U, Carrefour, Leclerc, and Monoprix, pushing temperatures from as low as minus 27 degrees Celsius to well over 50 degrees Celsius. Shops had to discard vast quantities of fresh meat, dairy, and frozen products, with individual supermarkets reportedly suffering losses ranging from tens of thousands of euros to more than 130,000 euros. The Paris prosecutor's office opened a formal investigation into the French attack, and France's national cybersecurity agency, Ansii, was instructed to investigate. The agency subsequently reported that supermarkets using controllers from two other companies had also been targeted, though authorities did not indicate who could have been behind the incidents and there were no claims of responsibility. The head of Sweden's national cybersecurity centre said the country had quite a lot of exposed operational technology devices that needed updating or patching. The EU food and agriculture commissioner described the repeated cyber-attacks as deeply concerning and a deliberate attempt to disrupt the food supply chain and undermine consumer confidence.

Sources

Sources available to members: 2 sources.