Cyberattacks on supermarkets have ceased to be limited to the theft of personal data, problems with electronic payments, or the blocking of websites. A new wave of computer incidents recorded this Monday, November 2 in Belgium and Sweden has shown that criminals can also alter the functioning of essential physical equipment for commercial activity. On this occasion, the target has been the refrigeration and freezing systems, whose temperatures shot up during the early hours until reaching 55 degrees Celsius in some establishments.
The consequences have been immediate. Dozens of supermarkets have had to withdraw fresh and frozen products, some establishments have temporarily closed and the first estimates point to losses of millions of euros. The situation recalls the attack recorded in France last October 12, when hundreds of businesses suffered similar alterations. However, the authorities have still not confirmed that the two episodes are related nor have they publicly identified those responsible for the new incidents.
What has happened in the supermarkets of Belgium and Sweden?
The incidents occurred during the night from Sunday 1 to Monday 2 November, when the refrigeration systems of numerous establishments began to record temperatures far higher than those needed to preserve food.
In Belgium, the chain Delhaize detected alterations in about 40 supermarkets, while Carrefour confirmed incidents in at least 15 establishments and Spar reported problems in another five. Anomalies have also been registered in the refrigeration facilities of the butcher chain De Laet & Van Haver and similar incidents have been reported in Luxembourg.
According to the Belgian media outlet RTL, Delhaize sent a warning to the managers of its stores around 04:00 hours, after detecting abnormal temperature increases. In several establishments the equipment reached about 15 degrees, although in a Belgian supermarket temperatures close to 45 degrees were recorded. Some managers resorted to refrigerated trucks in an attempt to save the merchandise, while others had to discard the stored products.
In Sweden, the chains ICA and Coop also confirmed problems in their refrigeration systems. Reuters reported six Coop supermarkets affected, while other reports raise the number of establishments in that chain to seven. ICA acknowledged incidents in a limited number of stores, some of which had to temporarily suspend operations.
One of the most striking cases occurred in a ICA supermarket in Boda, on the Swedish island of Öland, where workers found water on the floor and checked that a freezer had reached 55 degrees.
How do cybercriminals manage to raise the temperature of freezers?
The key lies in the computer systems that control supermarket refrigeration facilities.Many establishments use connected equipment that allows temperatures to be monitored, maintenance operations to be scheduled, and parameters to be modified remotely. This technology facilitates the management of large retail spaces, but it can also become an entry route for attackers if it does not have the appropriate security measures.
In the attack recorded in France in October, investigators detected that cybercriminals had managed to manipulate the refrigeration controls to activate defrosting processes abnormally. These cycles, which normally serve to remove frost from the equipment, were altered so that the refrigerators stopped preserving food at the necessary temperature.
In some French establishments, temperatures reached 50 degrees for several hours, causing products to thaw and even material damage. The investigations identified vulnerabilities in certain industrial control systems, including equipment that used outdated software.
It has not yet been proven that the incidents in Belgium and Sweden were produced by the same procedure. The similarities in the effects suggest possible manipulation of the controls, but the companies and investigators must determine how the access occurred and which systems were compromised.
The figures are provisional and may vary as the companies review their establishments. Furthermore, the fact that similar incidents have been recorded in different countries does not necessarily mean that there is a single coordinated attack.
Why can the economic losses reach several million euros?
The main economic damage comes from the break in the cold chain. Supermarkets must keep numerous products at specific temperatures to guarantee their safety. When the equipment stops working properly for several hours, foods such as meat, fish, dairy products, and frozen goods can lose the conditions necessary for their marketing.
Although the temperature of the cold rooms is later managed to be reduced, refreezing the products does not guarantee that they are fit for sale. For this reason, the affected establishments have to evaluate the merchandise and remove those whose safety cannot be substantiated.
According to the initial estimates collected by the Financial Times, the damage to the affected supermarkets in Belgium and Sweden could reach millions of euros, although there is still no definitive, joint figure. In addition to the loss of food, the costs of cleaning, repairing facilities, inspecting equipment, and temporary closure of establishments must be added.
The precedent in France is especially significant. The attack of October 12 affected hundreds of supermarkets and caused estimated losses in tens of millions of euros. The magnitude of the incident forced the French cybersecurity authorities to intervene and open an investigation to determine who had manipulated the systems.
Who is behind the cyberattack on the supermarkets?
At the moment, there is no official attribution of the incidents recorded this Monday in Belgium and Sweden. The affected companies have acknowledged disruptions in their computer systems, but the investigations must establish whether this is the same operation, different attacks, or incidents related to a shared vulnerability.
The French investigation remains open as well. The authorities of that country are analyzing the unauthorized accesses to the refrigeration equipment and are collaborating with specialized cybersecurity bodies to determine the origin of the attacks.
It has not been demonstrated that there is a specific organization behind all the cases nor that the incidents are linked to a State. The temporal coincidence and the technical similarities constitute relevant elements for the investigation, but they are not sufficient to identify those responsible.
Could a similar cyberattack occur in supermarkets in Spain?
The connected refrigeration systems used by Spanish supermarkets may present similar risks to those in other European countries, especially if they use obsolete programs, equipment without security updates, or poorly protected remote connections.
The problem is not linked exclusively to a retail chain or to a country, but to the security of the devices that allow industrial facilities to be controlled remotely. For this reason, cybersecurity specialists recommend keeping equipment updated, limiting remote access, using robust authentication systems, and separating industrial control networks from other computer networks.
So far, it has not been publicly confirmed that Spanish supermarkets have been affected by this new wave of incidents of November 2. This does not mean that the establishments are free from risks, but rather that there is no verified information that allows Spain to be included among the countries harmed by these specific episodes.
Concern also extends to other sectors that require constant refrigeration, such as food warehouses, logistics centers, pharmaceutical facilities, and certain industries.
What consequences can these attacks have for consumers?
The most immediate effect for consumers is the possible temporary shortage of some fresh and frozen products in the affected establishments. When a store loses a significant part of its merchandise, it may need time to inspect the facilities, receive new supplies, and recover its usual activity.
However, there is no evidence that these incidents have compromised customers' bank or personal data, since the problems reported this Monday are concentrated in refrigeration systems. Nor should the deterioration of stored food be confused with a generalized food alert: the affected supermarkets must withdraw the merchandise whose preservation cannot be guaranteed.
The incident raises a broader question for the European retail sector. Computer attacks can already translate into physical damage, disruptions to the food supply, and economic losses, even when payment systems or websites continue to operate normally.
The succession of incidents in France, Belgium and Sweden has highlighted the importance of protecting not only companies’ data, but also the technological facilities on which their daily operation depends. While the investigation continues, the main unknown is whether the episodes are due to the same vulnerability exploited in several countries or to independent attacks against similar systems.