Ahold Delhaize

Summary

Ahold Delhaize reported an IT incident affecting refrigeration systems in several of its stores across Belgium and the Netherlands, with temperatures in coolers and freezers rising enough to spoil food. The disruption was part of a wider wave of suspected cyberattacks on supermarket refrigeration equipment across multiple European countries, including Sweden, Ireland, Luxembourg, and Estonia, where other chains also reported compromised cooling units and discarded products. Investigators identified tampering with temperature-control technology, including units switched to defrost mode, though no group claimed responsibility and the perpetrator remained unidentified.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On Sunday night, Dutch retailer Ahold Delhaize confirmed that an IT incident took place in a number of its Delhaize shops in Belgium, impacting refrigeration systems. The company told NBC News that it was aware of the situation and that its teams were working hard to fully assess what had occurred. Stephan Moelans, the CEO of Belgian refrigeration company Sabcobel, which operates Delhaize's systems, told the Belga news agency that the incident was a cyberattack in which the units' evaporators were switched to defrost mode. The attack was part of a wider wave of suspected cyberattacks that struck supermarkets across Europe on Monday, affecting stores in Sweden, the Netherlands, Belgium, Ireland, Luxembourg, and Estonia. Refrigeration and freezer units at dozens of stores experienced sudden temperature spikes, with some units raised to as high as 122 degrees Fahrenheit. In the broader incident, supermarket groups including Ahold Delhaize and Colruyt were hit in Belgium and Luxembourg, while Swedish grocers ICA and Coop also reported disruptions. The timing of the attacks varied, with at least one affected store reporting that the incident occurred at 2 a.m. but was only noticed hours later when staff arrived in the morning. Automated monitoring systems alerted some companies to the issue, while others learned of the problem through employee reports or customer complaints. No group publicly claimed responsibility for the attacks, and authorities did not indicate who could have been behind them.

The impact on Ahold Delhaize included spoiled food and empty refrigerated shelves at affected locations. Photographs taken on November 2 showed shoppers passing empty refrigerated shelves at a Delhaize Shop & Go store in Leuven, Belgium, and a Proxy Delhaize store in Maleizen, Belgium, following a refrigeration outage. A store manager in Maleizen was seen disposing of spoiled produce after the outage. Across the wider European incident, grocery chains were forced to throw away chilled and frozen products, with one Belgian butchery chain owner estimating that roughly 15,000 euros worth of meat was ruined after fridges were turned up to as high as 18 degrees Celsius. In Sweden, an ICA store reported that freezer temperatures reached 50 degrees Celsius, and the store wrote on social media that it was working to discard affected items. Musgrave Group in Ireland said chilled and frozen products in 13 SuperValu sites were removed from sale as a precaution. Carrefour reported that 15 of its more than 700 stores in Belgium were affected, while Coop said seven of its 800 Swedish stores experienced unauthorized tampering with refrigeration systems. IKEA reported that at least one store in Belgium was impacted. The French attack the previous month had disabled refrigeration systems at some 700 stores, forcing shops to throw out damaged food, and Ahold Delhaize had also reported a cybersecurity incident to police during that period.

Response actions centered on assessment and containment. Ahold Delhaize stated that its teams were working to fully assess the situation, though the company has not publicly disclosed the specific cause of the incident. Sabcobel, as the operator of Delhaize's refrigeration systems, identified the attack method involving evaporators being switched to defrost mode. Danfoss, the Danish maker of refrigeration systems whose products were involved in incidents across Europe and in the prior French attack, said it had been working with customers to implement fixes. In Estonia, a grocery chain using an older type of Danfoss refrigeration control system had the issue fixed in minutes. Kesko in Finland began investigating after receiving automated alerts and as staff entered premises in the morning, noting that only a couple of smaller grocery stores outside the scope of centralized safeguards were affected. Ahold Delhaize had previously experienced days of service outages and empty shelves across its stores in the Netherlands during the prior month's cyberattack, and the company had still not said what caused that problem. Belgian authorities and cybersecurity officials expressed concern about the growing number of incidents, with a spokesperson for Belgium's Centre for Cybersecurity stating that it was not known who was behind the attack and that it may never be determined. Moscow denied involvement in sabotage or hybrid warfare operations, and investigators could not establish whether the Monday attacks were linked to the incidents in France.

Sources

Sources available to members: 3 sources.