Seven Intermarché stores in Portugal were caught in Europe's supermarket fridge hack
Overnight into Monday, a cyberattack on an outside contractor that runs refrigeration hit seven Intermarché stores in Portugal, the same night dozens of supermarkets in Belgium, Sweden, Ireland, the Netherlands, Luxembourg and Estonia saw fridge temperatures climb. Three Portuguese stores had to throw food away. Police and the national cybersecurity centre are assessing it.
Seven Intermarché supermarkets in Portugal had their refrigeration systems hit by a cyberattack in the early hours of Monday. It was the same night that fridges and freezers in dozens of stores elsewhere in Europe started warming up with nobody in the shop touching a dial.
Grupo Os Mosqueteiros, which runs the chain in Portugal, confirmed the incidents and said the target was an outside contractor that manages the stores’ refrigeration. It hasn’t said which stores, and all seven are open. The group says its supply chain wasn’t affected and that food hygiene and safety are assured.
Food binned in three stores
Portugal’s retail association, APED, says only one member has reported anything like this so far: these seven stores. Three of them lost stock, and what was pulled will be destroyed. The Polícia Judiciária is assessing the case with the national cybersecurity centre (CNCS) and hasn’t yet said whether it was deliberate.
One night, several countries
Elsewhere it looked worse. In Belgium, Delhaize and Carrefour stores were hit. At least 13 SuperValu shops in Ireland, ICA and Coop stores in Sweden, and branches in Luxembourg, the Netherlands and Estonia were too, plus at least one Belgian IKEA. Some freezers reportedly reached 50°C. One store manager in Stockholm put it simply: everything was ruined.
The EU’s agriculture commissioner, Christophe Hansen, called it a deliberate attempt to disrupt the food supply chain. Nobody has claimed it.
France saw this first
In October, hundreds of French supermarkets (Intermarché among them) were hit in the same way, with spoiled food and a few fires. Intermarché’s parent company put its losses at several million euros.
Some of the affected kit runs on controllers made by Denmark’s Danfoss. In August the security firm Claroty published flaws it had found in those refrigeration controllers and says the maker fixed them in an update. Whether the stores hit this week had installed it, or whether that flaw was the way in, isn’t known.
It’s the second time in two days that a hack has reached into the physical world. On Sunday it was alert apps in Ukraine and Russia pushing fake nuclear warnings. This time it was the yoghurt aisle.
By Oliver Grant
Illustration: Tugadaily
