IKEA

Summary

Ikea reported that one of its stores in Mons, Belgium, was affected by suspected cyberattacks that disrupted refrigeration and freezer systems across multiple European supermarkets. The incidents caused temperatures to rise in cooling units, leading retailers to discard spoiled food and remove chilled and frozen products from sale, while Danfoss refrigeration-control equipment was implicated and thousands of potentially vulnerable systems remained exposed online despite no group claiming responsibility.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On Monday, supermarkets across Europe reported suspected cyberattacks that resulted in sudden changes in the temperatures of their fridges and freezers. Incidents were reported in Belgium, Ireland, Sweden, Finland, and Estonia. Ikea stated that one of the company’s stores in Mons, Belgium, was affected. An Ikea spokesperson wrote in an email that the company is investigating the nature and scope of the incident. The suspected attacks involved refrigeration systems made by Danish manufacturer Danfoss, the same products implicated in incidents in France the previous month. In France, some 700 stores were hit by cyberattacks that disabled refrigeration systems and forced shops to throw out damaged food, with Intermarche, Cooperative U, and Carrefour among the chains impacted. No group has publicly claimed responsibility for the latest incidents.

In Belgium, Ahold Delhaize confirmed an IT incident in a number of Delhaize shops on Sunday night that impacted refrigeration systems, while Carrefour Belgium reported 15 of its 700 outlets were affected and Spar said refrigeration in around five stores was hit. In Ireland, Musgrave Group said a cyber incident affected refrigeration systems in 13 SuperValu sites, leading to the removal of chilled and frozen products from sale before the issue was resolved and stores returned to normal operations. In Sweden, ICA and Coop chains experienced higher freezer temperatures, with ICA Kvantum in Sjobo reporting that freezer temperatures had been raised to 50 degrees Celsius and Coop confirming seven affected stores and a hack, while ICA Sverige acknowledged a limited number of affected stores receiving support without confirming a cyberattack. In Finland, Kesko Oyj reported temperature anomalies in a few smaller K-food grocery stores after automated alerts, noting the issue was not widespread and affected only a couple of stores outside centralized safeguards, with an IT-related incident not ruled out. In Estonia, Selver experienced the problem at its only store still using an older type of Danfoss refrigeration control system, and the issue was fixed in minutes. Nearly 5,000 potentially vulnerable Danfoss systems remained exposed online before the latest incidents, and nearly 1,000 remained online even after the attacks became public on Monday. Forescout Technologies has identified more than 20 confirmed attacks against refrigeration systems since the start of the year.

Sources

Sources available to members: 1 source.