Suspected Hack Overheats Supermarket Fridges in Several Countries, Including the UK

A suspected cyberattack pushed up temperatures in fridges and freezers at supermarkets in several countries overnight into Monday, forcing some stores to throw away spoiled food. Britain's National Cyber Security Centre (NCSC) said Tuesday that a couple of instances had also been recorded in the UK, though it described the impact there as minimal.

Here is what the reports from The Independent and the BBC say about what happened and what is still unknown.

What happened to the supermarket fridges?

The Independent reported that an IT incident hit refrigeration systems in dozens of stores in Belgium, Estonia and Luxembourg, according to retailers Ahold Delhaize, Carrefour and Colruyt. Swedish grocers ICA and Coop and an Ikea superstore reported similar temperature rises. In Ireland, 13 SuperValu stores were affected by a suspected cyberattack.

The BBC put the number of affected Delhaize supermarkets in Belgium and Luxembourg at around 40, with a smaller number of shops hit in Sweden, Ireland, the Netherlands, Estonia and Finland. The BBC also said hundreds of stores were targeted overall and that the spoiled fresh and frozen food was estimated to be worth millions of euros. The two outlets give somewhat different pictures of which retailers were affected, and no full count has been published.

How did the attack work?

Stephan Moelans, chief executive of the Belgian refrigeration company Sabcobel, said the incident was a cyberattack in which the units' evaporators were switched to defrost mode. The BBC reported that the same method was thought to have been used in an incident last month in France. According to the Independent, French police said hackers took control of cooling units at hundreds of supermarkets in that case, raising temperatures as high as 50C and causing fires and food loss.

The BBC said Monday's attacks exploited weaknesses in systems used to remotely control and manage refrigeration units. Cyber-security researchers had flagged those weaknesses months earlier.

What did stores and suppliers report?

One Swedish ICA store said its refrigerator and freezer temperatures were set to 50C overnight, and it later reopened. At an ICA Baronen store in Stockholm, the sales manager said the attack began at 2am local time but was not noticed until 5.30am. Colruyt Group said five shops that operate under its Spar franchise in Belgium had their fridge systems attacked, and Coop told local news that six of its stores were affected. Technology supplier Kitman Coldtech told Estonian broadcaster ERR that an Estonian chain was hit with temperatures set to 50C, without naming it.

Belgian butcher Luc De Laet told Reuters that his store in Hove, south of Antwerp, had fridges turned up as high as 18C, which ruined about €15,000 worth of meat. "It's very scary," he said. Mathieu Tilman, who runs a Delhaize store in Belgium, told the BBC that throwing away so much food was distressing. The BBC said some retailers put their losses at hundreds of thousands of euros in lost produce.

How was the UK affected?

NCSC chief executive Dr Richard Horne told BBC Radio Four's Today programme that his agency had worked through the night to alert organizations that might be exposed. The British Association of Independent Meat Suppliers, which has more than 300 members, said some of them became what it called "collateral." Two members saw their fridges begin to defrost, and another saw its cold units climb to 100C (212F). A spokesman said the devices were empty at the time, so no produce was lost.

The BBC said there were little to no signs of impact at UK supermarkets so far. Graham Wynn of the British Retail Consortium, whose members include Asda, Lidl, M&S, Sainsbury's and Tesco, said retailers are working with the NCSC to secure their fridges and freezers. NCSC operations director Paul Chichester said officials are helping organizations find and close vulnerabilities before they can be exploited.

Who is behind it?

That is not known. Horne said it was too early to say who was responsible. Ahold Delhaize said it is investigating. The company had reported a separate cyber security incident to police in October after detecting suspicious activity in its infrastructure, and it noticed the temperature increases on Monday. The Independent did not say whether the two events are connected. De Laet said he believed the hackers were trying to destabilize economies. That is his view, and no investigator has said so.

What does this mean for shoppers and food businesses?

For shoppers, the immediate effect described in the reports is lost stock and, in some cases, closed stores or broken freezers, rather than any reported shortage. The cost has fallen mainly on retailers and suppliers, which have had to discard spoiled goods.

Horne said many organizations run systems beyond their intended lifespan, fail to upgrade them or leave them connected to the internet instead of isolating them. He added that adversaries using artificial intelligence could find and exploit such weaknesses more quickly. He said organizations should review what they depend on and invest in renewal. The meat suppliers' association urged food businesses at every stage of the supply chain to stay vigilant, saying they may be seen as targets.

Around Prague, based on reporting by The Independent, BBC