A Delhaize cyberattack left around 40 of the chain’s Belgian supermarkets short of fresh and frozen stock on Monday, 2 November, after attackers switched fridges and freezers into defrost mode overnight. Grocery stores in Ireland, Luxembourg and Sweden reported the same problem that night, with some appliances pushed as high as 50ºC, according to The Register.
The incidents come less than a month after a similar wave of attacks in France. In mid-October, Carrefour, Coopérative U, Intermarché, Monoprix and other chains threw out large volumes of produce after someone remotely defrosted their refrigeration. Hundreds of stores reportedly felt the impact.
Delhaize cyberattack forces stores to bin stock
Diego Louwers, who manages a Proxy Delhaize store in Overijse near Brussels, told RTL Info the consequences were “catastrophic”. His store had to discard its entire range of fresh and frozen products.
“We can’t have anything worse in our line of work,” Louwers said. “We have to throw away all of our merchandise, and it’s both heartbreaking and very complicated operationally.”
A Delhaize spokesperson said the company identified an IT incident affecting refrigeration systems in several dozen stores on Monday. The stores stay open, but the fresh and frozen range is “temporarily somewhat limited”. Meanwhile, the company says its distribution centres are working normally and deliveries to shops continue without disruption.
Other Belgian retailers report problems too. Around 15 Carrefour stores are reportedly hit, along with sites run by Intermarché, Spar and the Shop & Go stores at Q8 service stations. Butcher chain De Laet & Van Haver also saw temperatures rise in its appliances. However, it said on Monday that its meat was unharmed and all of its shops remain open.
Swedish and Irish chains report the same pattern
In Sweden, ICA confirmed an overnight incident that hit the refrigeration and freezer systems of a “small number of ICA stores operating outside ICA’s central network”. The company did not say how much food it lost or when normal operations would resume.
The ICA Nära store in Böda, on the island of Öland, posted on social media that it was open but had no fresh or frozen produce to sell. Store manager Mats Olsson told SVT he arrived on Monday morning to a puddle of water and freezers set to 55ºC. Other Swedish store managers described similar scenes.
Coop also reports fridge and freezer problems at six locations in central Sweden. In Ireland, parent company Musgrave told RTÉ that at least 13 of its SuperValu stores are throwing out fresh and frozen food.
Link to the French attacks is unconfirmed
Some of the French stores hit in October ran outdated firmware on Danfoss refrigeration controllers. Shortly after those attacks, France’s national computer emergency response team, CERT-FR, issued an alert about compromises of Danfoss AK-SM and AK-SC controllers. Still, not every victim used Danfoss hardware: Coopérative U confirmed it was not a Danfoss customer.
It is not yet clear whether the Delhaize cyberattack and the other incidents this week used the same method as the attacks in France. None of the companies that spoke to The Register on Monday answered questions about who carried out the intrusions.