A cyberattack affected dozens of supermarkets in Belgium during the early hours of this Monday after the attackers managed to gain remote access to the computer systems that control their refrigeration facilities. The intrusion made it possible to modify the configuration of the equipment, stop the compressors and activate the defrost mode of the evaporators, which caused a rise in temperature in cold rooms and freezers.
The incident has affected around 40 Delhaize stores and another 15 Carrefour ones, although problems have also been recorded in Spar chain stores and in the meat company De Laet & Van Haver, based in Antwerp. In some establishments, the freezers reached temperatures close to 15 degrees, according to information released by Belgian media.
The attackers' intervention was not limited to blocking the systems or preventing the normal functioning of the establishments. In this case, remote access made it possible to directly modify the parameters of the refrigeration equipment, with consequences for food preservation. The alteration of these devices forced the affected businesses to activate emergency protocols during the night to prevent the incident from spreading and reduce merchandise losses.
Delhaize has described what happened as a "computer incident". For its part, the butcher shop chain De Laet & Van Haver has confirmed that the settings of its refrigeration systems were modified from outside. Specifically, the evaporators were switched to defrost mode, a function that is part of the regular maintenance of these devices, but which, when activated simultaneously or outside the expected cycles, causes a rise in temperature.
The first alerts arrived during the early hours of the morning
The attack began around midnight, although some managers of the establishments did not detect its consequences until several hours later. A Delhaize manager explained that the first alarms arrived around three in the morning. When checking the state of the facilities, he found the compressors stopped and the refrigeration systems expelling hot air instead of maintaining the temperature necessary to preserve the products.
The incident forced supermarkets to react quickly. Some establishments resorted to refrigerated trucks to transport and preserve the food while the operation of the facilities was restored. Others had to remove and discard part of the affected merchandise given the impossibility of guaranteeing that the cold chain had been maintained.
The technical response was also set in motion during the night. The specialized company Sabcobel mobilized its first technicians starting at one in the morning to intervene in the affected systems. Its CEO, Stephan Moelans, explained to the Belga agency that some 20 systems had been affected among the hundreds of installations the company manages.
The extent of the incident among different chains and establishments points to an operation that has reached refrigeration systems of different operators. The alteration of these devices is especially relevant because it affects an infrastructure essential for the daily functioning of supermarkets: it is not only about preventing access to a company's computer systems, but about using that access to modify the behavior of physical installations.
A pattern similar to the one recorded in France
The Belgian episode comes just three weeks after a series of similar attacks against supermarkets in France. In that case, the refrigeration systems of more than 350 establishments were subjected to manipulations, although some reports raised the scope of the incident to 700 stores. Episodes were also reported in the Netherlands and Belgium, which places the attacks in a context of growing concern over the security of digital systems that control industrial and commercial installations.
The chain of incidents is not limited to Belgian supermarkets. In Sweden, ICA establishments also suffered attacks during the night, with reports indicating that some systems even registered temperatures of up to 50 degrees. The coincidence in the type of infrastructure affected and in the method used raises questions about the vulnerability of connected devices that manage refrigeration installations.
These devices are part of the so-called industrial control systems, which make it possible to monitor and regulate physical processes through computer tools. Their connection to digital networks facilitates remote management and maintenance, but it can also open new access routes for those who manage to breach their security measures. In the case of supermarkets, a manipulation of this type can translate directly into material damage, product losses and problems in ensuring food safety.
The attack occurs, moreover, after Ahold Delhaize, the parent group of the Belgian chain, managed to recover last week from another cybersecurity incident. These are, however, different episodes and there is no publicly confirmed connection at the moment between both attacks.