Belgian and Luxembourg retailers report overnight hits

Ahold Delhaize and Colruyt said early Monday that an overnight IT incident had hit fridges and freezers in dozens of stores across Belgium and Luxembourg. The reports came as part of a broader wave of abrupt temperature spikes in refrigeration units across the three countries.

• •Delhaize spokesperson Sarah De Meester said the chain noticed temperature increases in its cooling systems on Monday and is investigating the incident.
• •Stephan Moelans, CEO of Belgian refrigeration company Sabcobel, which operates Delhaize's systems, told Belga the incident was a cyberattack in which the evaporators were switched to defrost mode. His office later declined to comment when contacted by Reuters.
• •Carrefour Belgium reported disruption in about 15 of its 700 stores in the country.
• •Colruyt Group said five Spar shops it operates in Belgium under a franchise system had their fridge systems attacked.

Mich Vergauwen, a spokesman for Carrefour Belgium, put it plainly: "It's a cyberattack, there is no other reason."

Ikea joins the list with its Mons store

Ikea announced in the afternoon that its retail refrigeration control systems in Belgium had also been affected. A spokeswoman for Ikea Belgium said a cyberattack hit its store in Mons, southwestern Belgium, causing freezer temperatures to rise suddenly in the early hours of Monday.

According to the spokeswoman, the Mons store is the only Ikea location affected because it uses a different service provider than the other Belgian stores, though the provider was not named. Ikea said it "cannot rule out that additional locations may be affected".

Sweden counts affected stores as cybersecurity centre works the cases

Swedish grocers ICA and Coop reported similar temperature spikes, with one store blaming a cyberattack. At the ICA Baronen store in Stockholm, a notice said all freezers were broken due to a cyberattack; the sales manager said the attack happened at 2am (0100 GMT) and was noticed at 5:30am. A Swedish ICA store said on social media that its refrigerators and freezers had been "hacked" overnight and set to 50°C, and later said the store had reopened.

An ICA spokesperson said in an email: "We are aware that a limited number of stores were affected by an incident overnight, which impacted their refrigeration and freezer systems."

• •Coop told Swedish daily Aftonbladet that six of its stores had been affected by similar incidents; it did not immediately respond to a request for comment.
• •John Billow, head of Sweden's national cybersecurity centre, told Reuters it was working on several incidents regarding refrigeration systems in grocery stores around Sweden.

Billow added that in recent weeks the centre had identified that Sweden has quite a lot of exposed operational technology devices in need of updates or patches. Remotely controllable devices such as refrigerators, heating systems, security cameras and alarm networks create new opportunities for cybercriminals, the report notes.

Estonia hit and October's French attack still unexplained

An Estonian supermarket chain was also affected, with temperatures set to 50°C, technology supplier Kitman Coldtech told public broadcaster ERR. Kitman CEO Jann Mutso told ERR: "This is very fresh, it happened this morning." He declined to name the affected grocery chain.

The new incidents follow a similar October attack on hundreds of supermarkets across France, which triggered food loss and fires. Police said hackers seized control of cooling units at hundreds of supermarkets there, raising temperatures as high as 50°C and causing fires and food losses. Separately, Ahold reported a cybersecurity incident to Dutch police last month after detecting suspicious activity in its infrastructure.

Authorities have not indicated who could be behind last month's incidents, and there were no claims of responsibility. Investigations are under way at Delhaize and Sweden's national cybersecurity centre, and Ikea says it cannot rule out that additional locations may be affected; no attribution or claims of responsibility have been made.