Supermarkets in seven European countries have been hit by a second cyberattack on their refrigeration systems, a month after hundreds of French stores lost stock in a similar attack.
Around 40 Delhaize supermarkets in Belgium and Luxembourg were affected, along with a smaller number of stores in Sweden, Ireland, the Netherlands, Estonia and Finland. Temperatures in some freezers reportedly rose as high as 50°C.
Sabcobel, the Belgian company that manufactures some of the affected units and operates Delhaize’s refrigeration systems, said the evaporators had been switched to defrost mode. That’s believed to be the same method used in October’s attack in France. Its chief executive, Stephan Moelans, said the company had been working through the night to disconnect affected units from the network. He said the units needed physical modifications, not just software updates, to protect them against the vulnerability.
Several retailers have confirmed incidents. Carrefour said 15 of its Belgian stores were affected. Colruyt Group, which runs Spar stores in Belgium under franchise, said five shops were hit. Ikea said refrigeration at its Mons store was affected and that it could not rule out further locations. Musgrave Group said 13 SuperValu supermarkets in Ireland were affected, limited to a specific model of refrigerator. In Sweden, ICA said a small number of stores outside its central network were affected, and Coop said seven of its 800 stores were hit.
Danfoss, whose controllers were linked to the French attack, said the cooling systems of at least 17 businesses in the Netherlands were attacked, including butchers and small neighbourhood stores. One Delhaize branch in Belgium estimated its stock losses at €100,000, before accounting for lost trade while it was closed.
The UK’s National Cyber Security Centre said it was working with international partners and industry to understand the incident. No incidents have been reported in the UK. Belgian and Swedish cybersecurity agencies said they were monitoring the situation. US authorities are investigating refrigeration malfunctions at several American military bases in August, and working with French officials to establish whether they are linked.
Philip James, partner and co-head of international data, privacy and cybersecurity at law firm Browne Jacobson, said the attacks exposed exactly the risks EU and UK regulators are now tackling.
“Many of these risks come from connected devices, cloud systems and outsourced IT services,” said James.
He pointed to the EU’s NIS2 Directive, Cyber Resilience Act and Critical Entities Resilience Directive, as well as the UK’s product security rules for connected devices and the proposed Cyber Security and Resilience Bill. He said retail, food and consumer businesses were now mapping where they are exposed and who they depend on, much as financial services firms have done under the EU’s Digital Operational Resilience Act.
As IB has reported, the French attack exposed a gap between cyber and property cover. Cyber policies often exclude physical loss, while property policies with spoilage cover may contain cyber exclusions. Lockton has warned of physical loss exclusions, after reporting €270,000 of stock losses at just two French stores.
The second wave adds new complications. The attacks now span several countries, retailers and equipment makers, which raises questions about aggregation for insurers and reinsurers holding exposures across Europe. If attackers are found to be state-backed, war exclusions in cyber policies may come into play. The fact that Sabcobel says physical modifications were needed also raises questions for policyholders about patching and security conditions.
No UK stores have been hit so far, but the spread to Ireland, a market closely linked to the UK, makes the risk harder to ignore. Brokers with retail, food, hospitality and pharmaceutical clients should check now whether property spoilage cover carries a cyber exclusion, whether cyber policies cover stock loss and physical damage, and whether specific perishable goods cover is available.
Clients should also find out who manages their refrigeration and building controls, whether those systems are internet-connected, and whether the supplier has taken steps since the French attack.
