Spar

Summary

Spar was among several retailers across multiple European countries whose refrigeration and freezer systems were remotely manipulated in a wave of cyberattacks, causing temperatures to rise and forcing stores to discard chilled and frozen food. The incidents affected locations in Belgium and other nations, with attackers exploiting internet-connected refrigeration controllers from manufacturers including Danfoss and Copeland, some running outdated software that could not be patched. No group claimed responsibility, and authorities did not establish a motive, though the disruptions echoed earlier attacks on supermarket refrigeration in France.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On Monday, November 2, supermarkets across Europe reported suspected cyberattacks that resulted in sudden changes to the temperatures of fridges and freezers. Incidents were registered in Belgium, Ireland, Sweden, Finland, Estonia, Luxembourg, and the Netherlands, with more than 100 stores and other businesses experiencing refrigeration problems. In Belgium, Ahold Delhaize, Carrefour, and Spar reported issues with their refrigerators and freezers in shops. A spokesperson for Spar, a Dutch chain, said refrigeration in around five of its stores was hit. Other affected Belgian locations included Delhaize and smaller retailers. Ahold Delhaize confirmed that an IT incident took place in a number of its Delhaize shops in Belgium on Sunday night, impacting refrigeration systems, and said the incident affected refrigerators and freezers at dozens of stores in Belgium and Luxembourg. A spokesperson for Carrefour Belgium said 15 of its 700 outlets were impacted. The events followed a more widespread problem in France the previous month, when some 700 stores were hit by cyberattacks that disabled refrigeration systems and forced shops to throw out damaged food.

The incidents across Europe involved Danfoss refrigeration products, as was the case in France. Internet-connected refrigeration controllers allow technicians to remotely monitor temperatures, diagnose faults, and adjust equipment, and unauthorized access can allow attackers to change temperature settings or activate extended defrost cycles. In some affected locations, freezer temperatures were pushed above 50 degrees Celsius, leaving food spoiled. Chilled and frozen products in affected stores were removed from sale as a precaution, and grocers were required to throw away damaged food. In Ireland, Musgrave Group said refrigeration systems at 13 SuperValu stores were affected, forcing some chilled and frozen products to be removed from sale; the company later stated that the issue was resolved and all stores were operating as normal. In Estonia, attackers accessed a computer controlling refrigeration equipment at a Selver supermarket and set the temperature to 50 degrees Celsius, but the incident was detected and resolved within minutes, limiting the damage. In Finland, Kesko detected temperature anomalies at several smaller K-food stores and began investigating after receiving automated alerts.

After the supermarket hacks in France, many retailers took vulnerable Danfoss refrigeration-control systems offline for repairs or replacement, but nearly 5,000 systems remained exposed online and potentially vulnerable before the latest incidents. Even after the attacks became public on Monday, nearly 1,000 potentially vulnerable Danfoss systems remained online. Some of the compromised equipment in the Netherlands remained connected to unsecured networks and was still using default passwords. Equipment from another manufacturer, Copeland, was also reported affected in Belgium. No group has publicly claimed responsibility for the latest wave, and authorities have not identified the attackers or established their motive.

Sources

Sources available to members: 2 sources.