Supermarkets across Europe hit by new fridge cyberattacks

The Ahold Delhaize supermarket chain in the Netherlands told NBC News on Monday that it was aware of an “IT incident” affecting the refrigeration systems in a number of its stores. “Our teams are working hard to fully assess the situation,” the company said in an email.

Stephan Moelans, the CEO of Belgian refrigeration company Sabcobel, which operates Delhaize’s systems, told the Belga news agency that the incident was a cyberattack, in which the units’ evaporators were switched to defrost mode.

A spokesperson for Colruyt Group, which operates Spar stores in Belgium under a franchise system, said five shops had their fridge systems attacked. The Carrefour supermarket chain in the country said a “cyberattack targeting refrigeration installations only had an extremely limited impact,” affecting 15 of its more than 700 stores.

Sweden’s grocery retailer chain ICA told NBC News its systems were not affected, but that it had been informed of “an incident at a small number of stores that use an external supplier and have their connectivity outside ICA’s central network.”

The incident has affected the stores’ refrigeration and freezer systems, the company said in an email. “ICA is currently supporting the affected stores in managing the incident,” it said.

The ICA Kvantum branch in Sjöbo in southern Sweden wrote on its Facebook page that its fridges and freezers had been hacked and set to 122 degrees Fahrenheit. It said it was working to discard the affected items.

Privately held grocery retail group Coop told Swedish daily Aftonbladet that six of its stores had been affected by similar incidents.

In Ireland, food wholesaler Musgrave said that a cyber incident had affected refrigeration systems in 13 of its SuperValu stores, forcing it to remove some chilled and frozen products from sale.

“Our monitoring systems alerted us to the issue and we took immediate action,” it said in a statement. “Our investigation is ongoing.” The company did not immediately respond to a request for comment from NBC News.

In Estonia, a company that makes the affected technology said that one of its clients had been hit by a cyberattack in which attackers accessed a computer controlling refrigeration and also turned up the temperature to 122 degrees Fahrenheit, public broadcaster ERR reported.

From refrigerators and heating systems to security cameras and alarm networks, an expanding range of devices can now be monitored and controlled remotely, creating new opportunities for cybercriminals.

Sweden’s national cybersecurity center — which said it could not speculate on who was behind the attacks — is working on several incidents affecting grocery stores across the country, the head of the center, John Billow, said on Monday.

“We have in recent weeks... identified that we have quite a lot of exposed operational technology devices in Sweden that we have been clear about the necessity to update or patch,” the cybersecurity center’s Billow said.