A new wave of computer incidents affected this Monday, November 2, dozens of supermarkets in Belgium and Sweden, causing abnormal temperature increases in their refrigeration systems and the loss of large quantities of food. The affected stores discovered upon opening their doors that their refrigerators and freezers had stopped preserving products at the usual temperatures, reaching values of between 50 and 55 degrees Celsius in some Swedish stores. The incident has forced merchandise to be withdrawn and has caused temporary closures, while the companies investigate how the alterations occurred.
The chains Delhaize and Carrefour, in Belgium, and ICA and Coop, in Sweden, are among the main affected.According to information published by European media and partial confirmations from the companies, at least 40 Delhaize stores and another 15 Carrefour stores have registered problems in Belgium. In Sweden, six Coop supermarkets and several ICA supermarkets have reported similar incidents. Problems have also been reported in other Belgian establishments and in stores in Luxembourg.
The episode presents important similarities with the cyberattack registered on October 12 in France, when the attackers managed to remotely manipulate the refrigeration controls of hundreds of supermarkets. However, it has still not been officially confirmed that Monday’s incidents have a common origin or were carried out by the same perpetrators. The affected companies continue analyzing their systems, while concern grows over the vulnerability of industrial equipment connected to the internet.
More than 50 supermarkets affected in Belgium and temperatures of up to 55 degrees in Sweden
Belgium concentrates a significant part of the establishments affected by Monday’s incident. The Delhaize chain, owned by the Ahold Delhaize group, has confirmed to local media a computer problem in the refrigeration and freezing systems of several of its stores. The first estimates point to at least 40 supermarkets affected in Flanders and Wallonia, especially smaller establishments, such as the Proxy Delhaize and Shop & Go formats, although incidents have also been reported in conventional supermarkets.
According to the specialized media outlet RetailDetail, during the early hours the company alerted the managers of its stores to the sudden temperature increases. In some Belgian freezers, temperatures of approximately 15 degrees were reached, enough to compromise the preservation of products that must remain at temperatures below zero. Carrefour Belgium has also confirmed problems in 15 stores, while other reports point to incidents in shops of the Spar chain and in food establishments in Antwerp.
In Sweden, the disruptions have been even more extreme. An ICA supermarket located in Boda, on the island of Öland, recorded a temperature of 55 degrees in its freezing equipment, according to information collected by the Anadolu agency from Swedish media. Its manager, Mats Olsson, found the floor covered in water when he arrived at the store, after the stored products began to thaw during the night.
In another ICA supermarket in Sankt Olof, workers had to empty the freezers and remove food that could no longer be sold. The chain has confirmed that a limited number of stores suffered problems in their refrigeration equipment, while Coop has reported incidents in six establishments located in the regions of Gästrikland and Hälsingland. Some stores have had to close temporarily to inspect the facilities and remove the affected products.
How the attack works that turns freezers into heat chambers
The main risk of these incidents lies in the manipulation of industrial control systems that allow the remote management of the temperature of refrigerators and freezers. Unlike cyberattacks focused on the theft of personal data or the blocking of computers, this mode can have direct physical consequences, by altering the operation of equipment used to preserve food.
The clearest precedent occurred in France last October 12, when the attackers managed to remotely activate defrost cycles and raise the temperature of the refrigeration chambers to 50 degrees. In some establishments, according to information published by Le Monde, the thawing cycles were artificially prolonged, which made it possible to keep the equipment hot for several hours before the workers detected the problem.
The investigations into that attack identified refrigeration control equipment from manufacturers such as Danfoss and Copeland, some of them with old versions of software or systems that had stopped receiving security updates. These devices allow commercial facilities to be managed, but an insecure configuration or the exposure of their interfaces to the internet can facilitate unauthorized access.
At the moment, it has not been established that the problems recorded in Belgium and Sweden occurred through the exploitation of the same vulnerabilities. The similarities in the behavior of the equipment point to a comparable pattern, but it will be necessary to analyze the records of the affected systems to determine the mechanism used and establish whether there is a relationship between the different incidents.
Million-dollar losses from the destruction of fresh and frozen food
The economic impact of the incident is concentrated in the merchandise that has lost the necessary preservation conditions. The refrigerators and freezers of supermarkets store products that need to maintain a constant temperature to guarantee their food safety. When that cold chain is broken for several hours, foods such as meats, fish, dairy products or frozen items may stop being suitable for sale, even if later the equipment begins to function normally again.
According to what the Financial Times has published, the damages caused by the incidents in Belgium and Sweden are initially valued at millions of euros, although the companies have still not presented a joint and definitive economic balance sheet. In Sweden, the manager of one of the affected ICA supermarkets has estimated that the lost merchandise amounts to hundreds of thousands of Swedish crowns. Added to these losses are the expenses of product removal, cleaning, equipment inspection and possible temporary closures.
The French precedent shows how far the consequences can reach. The attack of October 12 affected hundreds of supermarkets and caused estimated losses of tens of millions of euros. The Intermarché chain was one of the main victims, along with stores of Carrefour, Leclerc, Monoprix and Coopérative U. The French Prosecutor's Office opened an investigation to determine the authorship of the events and establish the relationship between the manipulation of the systems and the material damages recorded, including some fires.
The authorities are investigating who is behind the attacks
The succession of incidents in different European countries has put the focus on the security of refrigeration facilities used by supermarkets and food distributors. These systems are part of the technological infrastructure of the establishments and, when they have remote access, can present risks if they do not have adequate protective measures.
The investigation into the French attacks remains open and has the participation of specialized bodies in cybercrime and cybersecurity. For now, responsibility has not been officially attributed to any group, organization, or State, nor has it been proven that there is a coordinated campaign behind all the episodes recorded in Europe.
The problems detected have also led to investigations outside the continent. The United States is examining possible attacks against freezing systems of establishments located on military bases, where alterations in temperature controls and food losses had been recorded.
The incidents in Belgium and Sweden show that a computer attack can cause consequences beyond the loss of data or the interruption of digital services. The manipulation of connected equipment can directly affect the activity of businesses, destroy merchandise and generate considerable economic losses. While companies assess the damage and strengthen their security systems, it remains pending to determine whether the failures recorded this Monday are related to the attack that affected France just three weeks ago.