Store refrigeration systems hit in at least six European countries overnight

Companies and refrigeration installers reported that cooling and freezer systems at supermarkets, butchers and other food businesses were altered remotely in at least six European countries on the night of 1 to 2 November. The countries are Belgium, Luxembourg, the Netherlands, Sweden, Ireland and Estonia. Nobody has claimed responsibility. Authorities have not said who was behind it.

Belgium had the largest cluster. Delhaize, owned by Ahold Delhaize, said it had identified an "IT incident" affecting refrigeration in "several dozen stores". Belgian media, including broadcaster VRT, put the number at more than 40. RTL Info reported that store managers received a text from Delhaize management at about 04:00 CET. It also reported that temperatures in some freezers reached about 15 degrees Celsius. RTL Today reported that Delhaize stores in Luxembourg were hit too. VRT and De Morgen reported that Belgium's federal prosecutor's office has opened a criminal investigation. About three weeks earlier, in the night of 11 to 12 October, hundreds of supermarkets in France were hit.

Companies and suppliers give differing accounts

Carrefour Belgium confirmed what it called a cyberattack at 15 of its roughly 700 Belgian stores, VRT reported. Spokesperson Mich Vergauwen told AFP: "It's a cyberattack, there is no other reason." Colruyt said about five independently run Spar shops were affected, and that its own stores were not. Stephan Moelans, chief executive of installer Sabcobel, told news agency Belga that attackers switched units into defrost mode, the same mechanism as in France.

In the Netherlands, Danfoss, the Danish maker of refrigeration controllers, told public broadcaster NOS that systems at at least 17 businesses had their temperatures changed. They were mainly butchers and small neighbourhood shops. Albert Heijn said none of its branches was hit.

In Sweden, ICA said "a limited number" of stores were affected and did not confirm a cyberattack. Coop said six of its roughly 800 stores had problems. Spokesman Carlos Cancino told AFP: "I haven't received any information that this is a cyberattack."

Musgrave said 13 SuperValu stores in Ireland were affected by a suspected cyber incident. In Estonia, Jann Mutso of refrigeration firm Kitman Coldtech told broadcaster ERR that at least one supermarket chain was attacked, with temperatures set to 50 degrees. He did not name it.

Unlock the Full Analysis:

Observers are reading: the French precedent, what investigators and suppliers say about the equipment, and where the evidence stops.

Become an Observer, it's free. Get full access to all Crisis.Zone analysis, briefings and breaking coverage.

Become an Observer, it's free

What is not known

Who is behind the incidents, and why, is not known. Nor is whether one actor is responsible, or whether Monday's incidents and the French attack used the same way in. Sabcobel's "same mechanism" account describes defrost mode, not the entry method. Counts of affected stores differ: De Morgen put the Belgian total at at least 76, and a BleepingComputer tally across countries came to more than 115. No total damage figure exists. One Proxy Delhaize owner put the store's loss at at least €60,000, Het Belang van Limburg reported via VRT.

Separately, Ahold Delhaize reported a cybersecurity incident to Dutch police in October after detecting suspicious activity in its systems, and took IT systems offline, Reuters reported. Delhaize told NOS it is checking whether there is a link to Monday's incidents. No link has been shown.

Belgium's food safety agency FAVV told stores to check product temperatures themselves and remove anything that may have been too warm, VRT reported. The situation is still developing. Developments to watch are any claim of responsibility, any attribution by investigators, and progress in the Belgian and French investigations.