Cyberattack hits supermarket fridges in Belgium and six other countries

A cyberattack disrupted refrigeration systems at supermarkets across Belgium and at least six other European countries overnight into Monday, forcing stores to throw away spoiled food, authorities and retailers said.

In Belgium, at least 76 stores were affected, including around 40 Delhaize Proxy outlets, 15 Carrefour Shop & Go stores, about five Spar locations tied to Q8 petrol stations, an IKEA store in Mons and several branches of the De Laet en Van Haver butcher chain, according to the retailers and Belgian media. Temperatures in some fridges and freezers climbed to around 15 to 17 degrees Celsius, and some stores destroyed all their chilled and frozen stock as a precaution.

Supermarkets and smaller shops in the Netherlands, Sweden, Luxembourg, Ireland, Estonia and Finland were also hit, with freezer temperatures in some cases reaching 50 degrees Celsius, European media reported. In Ireland, 13 SuperValu stores were affected, owner Musgrave said; several K Group stores were hit in Finland; and one branch of the Selver chain was affected in Estonia.

Belgium's federal prosecutor's office has opened a criminal investigation, and the country's Centre for Cybersecurity said it was aware of the incident but had no further information on who was responsible. Stephan Moelans, chief executive of Sabcobel, the company that manages refrigeration for Delhaize and other Belgian chains, said the attack exploited the same vulnerability in software made by Danfoss that was used in a cyberattack on around 150 French supermarkets in mid-October. Hackers remotely switched the units' defrost function on, causing them to overheat, he said.

Danfoss said the vulnerability lay mainly in outdated software that some customers had not yet updated. Moelans said fully fixing it often requires physical changes to hardware, not just a software patch, and that Belgian chains had been working for about three weeks to secure their systems since the French attack. The European Commission said the incident showed how cyberattacks can disrupt services and affect people's daily lives, and that it would keep working with EU member states to strengthen cybersecurity.