A fresh wave of cyberattacks targeting refrigeration systems has disrupted supermarkets in Europe.
The breaches were reported in countries including Sweden, Belgium and Luxembourg, resembling a similar attack on hundreds of French supermarkets last month.
The new round of cyberattacks affected major retailers including Delhaize in Belgium and Coop in Sweden.
A company spokesperson for Delhaize, part of the Netherlands-based Ahold Delhaize group, said “several dozen” of its stores were hit.
“In the affected stores, the range of fresh and frozen products is temporarily somewhat limited," the spokesperson said at just before 17:00 CET yesterday (2 November). "Our distribution centres are operating normally and there has been no disruption to deliveries to our stores.”
Colruyt Group, which operates Spar stores in Belgium under franchise model, saw five of its shops experiencing attacks on their refrigeration systems.
Carrefour issued a statement acknowledging the breach at its stores in Belgium, noting the impact was “extremely limited”.
The French retail giant confirmed 15 of its more than 700 stores in Belgium were hit, although it said none of its hypermarkets experienced disruption.
In Sweden, a spokesperson for Coop said yesterday afternoon seven of its more than 800 stores were affected, adding the situation was “contained and under control”.
“The issues have ranged from completely shut-down refrigerators and freezers to partially functioning units, and in one case, the system beginning to generate heat," the spokesperson said.
Fellow Swedish retailer ICA also reported an incident at a “limited number of stores that use an external supplier” but said its central systems were not affected.
The identity of those behind the latest apparent attacks remains unknown.
Michael Ferdinandsen, the CEO of Danish industrial cybersecurity company Secomea, said retailers need tighter controls over remote access to operational equipment.
"For retailers, the question isn't whether they need remote connectivity. They absolutely do. The question is whether they have sufficient control over who can access their equipment, what they can reach, and what they're allowed to do," Ferdinandsen said.
