Coop

Summary

A second wave of cyberattacks targeted supermarket refrigeration systems across eight European countries, forcing stores to discard large amounts of food after hackers raised fridge and freezer temperatures. The Swedish chain Coop reported that seven affected stores resumed operations with refrigeration disconnected from the internet while it reviewed its entire network for vulnerabilities, and it was migrating systems from 4G to 5G and modern modems. Other retailers, including ICA and Edeka, reported similar incidents involving independently operated stores with non-standardized equipment, while Carrefour experienced a repeat attack in Belgium following an earlier incident in France. Police in Sweden received multiple reports, and the EU cybersecurity agency emphasized the need for cross-border cooperation and coordinated incident response.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

European supermarkets were targeted in a second wave of cyberattacks that manipulated refrigerator and freezer temperatures, forcing stores across eight European countries to discard large quantities of food. The Monday attack was identical to one that had affected dozens of supermarkets in France three weeks earlier. In Sweden, supermarket chain Coop reported that seven of its stores were hit by the incident. Those stores have since returned to normal operations, though their refrigeration systems have been disconnected from the internet. A Coop spokesperson stated that the company was conducting a thorough and deep review of the status of its entire store network to determine whether any vulnerability existed anywhere in the network. Coop also said it was switching its systems to 5G networks and modern modems rather than 4G connections, a transition that had already begun following the earlier French incident.

The attacks affected retailers with varying operational structures. Many European supermarkets are run by independent business owners within a cooperative framework, meaning refrigeration systems are not standardized across stores. Software provider Danfoss, whose systems were among those targeted again, said it had been in close contact with customers over the previous three weeks to help them manage the situation. Swedish grocer ICA reported that all 23 stores affected in Monday’s attack had equipment connected outside the chain’s centrally managed store network. One ICA store owner in Tomelilla and Sjobo said he was frustrated because he had been in the process of changing security systems at those locations when they were hacked. Swedish police said around 10 reports had been filed since Monday and expected more. German operator Edeka reported a hacked fridge at a store in Reisbach and noted there are no standardized refrigeration systems across its network of independently run stores. Carrefour, which had 80 franchised stores in France compromised three weeks earlier, experienced the same attack at 15 stores in Belgium on Monday. The EU cybersecurity agency ENISA said the large-scale nature of the attacks across several member states underscores the importance of European cooperation, rapid information-sharing, and coordinated responses to cyber incidents. In Britain, hackers attempted to target small meat-processing firms with minimal impact, and the National Cyber Security Centre said it was working with organizations to identify and close vulnerabilities before exploitation.

Sources

Sources available to members: 1 source.