Nobody thinks much about cold until it goes. It sits behind glass doors in every supermarket on the continent, keeping the fish, the milk and the frozen peas from turning back into what they really are. Overnight between Sunday and Monday, 1 and 2 November, in stores across Belgium, Estonia, Ireland, Luxembourg and Sweden, the machines that make that cold started making heat.
By Monday morning retailers and authorities were blaming suspected cyberattacks, according to Reuters in a report carried by Al Jazeera. It was only weeks after the same thing happened in France, where intruders took over the cooling at hundreds of supermarkets, pushed fridges and freezers as high as 50C (122F), spoiled stock and caused fires in several stores. That attack has been described as coming through doors left open. The doors were apparently still open.
Defrost mode
The method was simple. Stephan Moelans, chief executive of the Belgian refrigeration firm Sabcobel, which looks after Delhaize’s cooling systems, said someone had switched the units’ evaporators into defrost mode. Belgian reporting carried by Euronews quoted him as saying the attack worked exactly like the earlier French one. Around 40 Delhaize stores in Belgium and Luxembourg were affected, while the news agency Belga spoke of dozens of Ahold Delhaize shops. Carrefour said 15 of its more than 700 stores were hit, and its spokesman left no room for doubt: “It’s a cyberattack, there is no other reason.” A Colruyt Group spokesperson said fridge systems at five Spar franchise shops had been attacked. Belgium’s federal prosecutor’s office has opened an investigation.
Ahold Delhaize, it emerged, had already reported a cybersecurity incident to Dutch police the month before.
In Sweden, ICA and Coop both reported freezer temperatures climbing suddenly during the night. An ICA spokesperson said “a limited number of stores were affected by an incident overnight.” Coop told the newspaper Aftonbladet that six of its stores were affected. Axfood said freezers had been hacked at a distribution centre near Gothenburg that supplies home grocery deliveries. One Swedish store wrote on social media that its fridges and freezers had been set to the same temperature used in France. An ICA Kvantum in Sjöbo, a small town in Skåne, put it bluntly on Facebook: a cyberattack had caused the trouble, as US News reported.
In Ireland, the wholesaler Musgrave said a “cyber incident” had hit one particular model of refrigeration at 13 of the 223 stores of SuperValu, the country’s third-largest supermarket chain. Chilled and frozen products came off the shelves. The company did not say what had gone wrong with the model.
In Estonia, Jann Mutso, chief executive of the supplier Kitman Coldtech, told the public broadcaster ERR that at least one supermarket chain had been hit, with temperatures set to 50C. He did not name it to Reuters, though other accounts named a Selver supermarket among those affected. “This is very fresh, it happened this morning,” he said.
Even the list of countries was unclear. NBC News added the Netherlands to the five, and Bloomberg included Finland. On the first day of a crisis, the count is always provisional.
The machine that used to be dumb
These systems used to work mostly by mechanics: a compressor, a thermostat, a dial someone turned by hand. Now they are connected, and anything connected can be reached from far away. John Billow, head of Sweden’s national cybersecurity centre, told Reuters his staff were handling several incidents involving store cooling systems. He said recent weeks had shown “quite a lot of exposed operational technology devices in Sweden” that still needed updating or patching.
There is a lesson here, if one is wanted, about the way modern institutions grow: they add a convenience, connect it to the wider world, and forget it until it is used against them. The French incident should have been the warning. On this evidence, in much of the north the warning was received and the machines stayed as they were.
No signature
Nobody has claimed Monday’s incidents, or the French one before them. The silence gets filled with the fears of the moment. European governments have lately blamed Moscow for a growing number of incidents against infrastructure, including cyberattacks, and the fridges have added to worries about hybrid warfare tied to Russia’s invasion of Ukraine and to the Iran–US war. Russia has repeatedly denied any part in sabotage or hybrid warfare.
In Brussels, the language hardened. Christophe Hansen, the EU Commissioner for Agriculture and Food, called the attacks “a deliberate attempt to disrupt” the bloc’s food supplies and an effort to undermine public confidence. A European Commission spokesperson said the incidents showed that cyberattacks can “directly affect citizens’ daily lives” and called for stronger cybersecurity across the Union. The national cyber agencies of Belgium and Sweden said they were monitoring, and Britain’s National Cyber Security Centre said it was working with international partners.
For the shopper, all this arrives as an empty freezer aisle, a notice on the glass, and produce written off before the doors open. For the people who have to throw it away, the morning is the same in Sjöbo and in a Brussels suburb: cartons gone soft, an alarm that went off too late, a manager on the phone to a refrigeration firm.
A spokesperson for the Centre for Cybersecurity Belgium described the rise in cyber incidents, especially those using targeted AI, as a trend still taking shape, and added something governments rarely admit out loud: “we may never be able to identify … who is behind this attack.”