ReutersA spate of cyber-attacks that hit supermarket chains across at least 10 European countries on Monday has prompted European Union officials to warn of a deliberate attempt to disrupt the food supply chain.
Supermarkets have reported problems in Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Germany and Sweden, and the significant increase in freezer temperatures has forced retailers to discard food.
Temperatures in chains across Europe reportedly rose as high as 50C (122F).
No-one has yet admitted carrying out the cyber-attacks.
The European Union has raised concerns about the attacks, which come three weeks after a cyber-attack disrupted as many as 700 French grocery stores, causing food losses estimated at tens of millions of euros.
The security of refrigeration systems as well as other devices that can be monitored remotely has heightened concerns about government-backed hybrid attacks.
The EU’s food and agriculture commissioner, Christophe Hansen, said the bloc was taking the incidents very seriously and warned of further disruption in the future.
Commission spokesman Thomas Regnier was careful not to attribute blame, but said: “These incidents of course show once again how cyber-attacks can disrupt essential services and affect citizens’ daily lives.”
“These are not isolated incidents and of course we have to be collectively resilient and prepared for such cyber incidents.”
In Italy, Giorgia Meloni’s government called a meeting with intelligence chiefs, but said the impact was “currently very limited” and most of the food distribution chain had up-to-date security systems able to fend off such attacks.
At least four Co-op supermarkets in Sicily and one business in Tuscany were affected, according to the national cybersecurity agency.
Meloni’s office said those businesses affected were “mostly still equipped with obsolete security systems, with interfaces directly exposed to the internet and inadequate authentication mechanisms”.
Belgian supermarkets were among those hardest-hit, with dozens of stores reporting refrigeration failures. Federal prosecutors have opened an investigation.
Mathieu Tilman, a manager at a Delhaize supermarket in Belgium, said he was shocked by this kind of attack: “I don’t even understand how anyone could do this… How can we end up throwing away so much food? I find it truly distressing. In moments like these, you just feel like quitting your job.”
In Ireland, 13 SuperValu stores were impacted by what the chain’s owner, Musgrave Group, called a cyber-incident. “Replenishment of chilled and frozen ranges in the affected stores is well under way,” a spokesman said on Monday.
A small number of corner shops in the Netherlands also suffered disruption. Last month, supermarket chain Albert Heijn had to take several services offline because of a separate cyber-attack.
There was disruption to refrigeration systems at the Rewe Büsken supermarket in western Germany after a cyber-attack on system provider Danfoss, the company told the BBC. Its systems have been back in operation since Monday afternoon.
In Portugal, the Mosqueteiros group said that incidents at seven Intermarché stores had been linked to a cyberattack, which “appears to have targeted an external service provider responsible for managing the refrigeration systems”.
Swedish chain ICA also said “a limited number” of its stores had experienced refrigeration problems, without confirming a cyber-attack, and Sweden’s national cyber-security agencies said they were monitoring the incident.
In Finland, irregular temperatures were detected in a few smaller grocery stores belonging to the Kesko group, which said it was investigating the issue.
In Estonia, at least one supermarket was attacked by hackers who raised the temperature in the refrigeration units to 50C, public broadcaster ERR reported.
EPAIn the UK, the National Cyber Security Centre (NCSC) has warned British retailers to update the software on fridge temperature controls.
The agency said the country was likely to suffer an AI-powered cyber-attack on critical national infrastructure within two years.
Richard Horne, the head of the National Cyber Security Centre, told BBC Radio 4’s Today programme there were a couple of instances in the UK where “vulnerable technology has been exploited” after the cyber-attacks.
“We don’t know the full impact, but we do know there are a couple of instances where vulnerable technology has been exploited and we’re working with those organisations.”
Asked if there was any evidence that supermarkets in Britain or freezers of the same make or model had been targeted, Horne said: “It’s not just supermarkets, it’s through the whole food supply chain, and we’ve been working through the night alerting organisations where we can see they’ve got exposed technology that’s vulnerable in this way.”
