European Supermarkets Hit by New Wave of Cyberattacks

A new series of cyberattacks disrupted supermarket operations across Europe on Monday and Tuesday, with hackers manipulating the temperature settings of refrigeration systems in Germany, Romania, and the United Kingdom. These latest incidents bring the total number of European countries affected by the ongoing hacking spree to at least eleven. Officials announced these developments on Tuesday as the European Union pledged a collective response, emphasizing that the attacks, which have resulted in the spoilage of significant quantities of food, should not be viewed as isolated events.

The specific motive behind the cyberattacks remains unknown, and no group or individual has yet claimed responsibility for the intrusions. A senior Romanian official stated that they do not suspect a state-sponsored actor is behind the disruptions. On Monday, problems were reported in at least nine EU member states, including Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal, and Sweden. By Tuesday, officials and company representatives confirmed that four supermarkets in Germany and six in Romania had been impacted.

Thomas Regnier, a spokesperson for the European Union, explained that EU agencies are in communication with national authorities to formulate a joint strategy. He stressed the need for collective resilience and preparedness against such cyber incidents, noting, "These are not isolated incidents, and of course, we have to be collectively resilient and prepared for such cyber incidents." However, the spokesperson declined to identify specific potential culprits behind the attacks.

Romania’s top cybersecurity official, Dan Cimpean, director of the National Cyber Security Directorate, characterized the threat as appearing semi-amateurish. In a statement to the AFP news agency, Cimpean said, "We do not suspect, under any circumstances, that it is a state actor." He further noted that no other infrastructure had been compromised during the incident.

Belgium was among the hardest-hit nations during the Monday attacks, with dozens of stores across multiple grocery chains reporting refrigeration failures. Federal prosecutors in the country have opened an investigation into the matter. In Italy, approximately twenty supermarkets were affected by the disruptions. Giuseppe Spadaro, who directs a group operating Coop supermarkets in Sicily, reported that four of its three hundred stores were hit, causing damage amounting to thousands of euros. He told the Corriere della Sera newspaper that the shelves were left empty because the inventory had to be discarded.

The Italian government held talks on Tuesday with heads of intelligence services and the National Cybersecurity Agency. Prime Minister Giorgia Meloni’s office issued a statement describing the impact of the incident as limited. The statement added that while there was no cause for alarm, all relevant institutional bodies remained on high alert.

In the United Kingdom, which is not a member of the EU, the impact was described as minimal. Richard Horne, chief executive of the National Cyber Security Centre, told the BBC that the issue affected the broader food supply chain, with a few instances where vulnerable technology had been exploited. He noted that hackers had attempted to target small meat-processing firms.

This second wave of attacks mirrors a previous cyberattack that swept through hundreds of supermarkets in France in October, which also affected stores in several other European countries. In Sweden, the supermarket chain Coop stated that refrigerators and freezers at seven of its stores were connected to old 4G networks, a vulnerability that had been addressed. Carlos Cancinos, a spokesperson for Coop, said the chain had accelerated an upgrade process to move connected refrigeration equipment onto 5G networks and modern modems, a move begun after the October attacks.

Danfoss, a Danish manufacturer of refrigeration controls whose systems were targeted again, said it had been in close contact with customers for the past three weeks. The company recommended that its systems should not be directly accessible from the internet. Frank Groenewegen, a cybersecurity expert at Deloitte in The Hague, urged retailers to verify if their refrigeration controllers were connected to the internet and running the latest security updates. He advised that if retailers were unsure, they should remove the systems from the public internet immediately to isolate them from attackers.