By Marie Mannes, Helen Reid and Louise Rasmussen
STOCKHOLM/BRUSSELS/LONDON, Nov 2 (Reuters) - European supermarket fridges are under cyberattack once again, with stores across a vast swathe of the continent from Sweden to Belgium hit by a hack on Monday that turned up their temperatures, echoing an incident in France just last month.
Supermarket chains Ahold Delhaize and Colruyt said an IT incident overnight hit fridges and freezers in dozens of stores in Belgium and Luxembourg, while Swedish grocers
ICA and Coop reported similar temperature spikes.
"There has been a cyberattack and all our freezers reached 50 degrees (Celsius)," Engla Ingwall, sales manager at an ICA franchise store in Stockholm, told Reuters, adding the attack occurred at 2 a.m. (0100 GMT) but was only noticed hours later.
"Everything is destroyed."
A spokesperson at privately held ICA said in an emailed statement that the company was aware that a "limited number of stores were affected by an incident overnight, which impacted their refrigeration and freezer systems".
The latest incidents follow an attack in France last month, in which police said hackers seized control of cooling units at hundreds of supermarkets, causing fires and food losses. Ahold also reported a cybersecurity incident to police last month.
While no-one has claimed responsibility for either attack, the cases have put a spotlight on rising anxiety among regional authorities over hybrid attacks spreading from conflicts on European borders after Russia's 2022 invasion of Ukraine.
Moscow has repeatedly denied involvement in any sabotage or hybrid warfare operations. Reuters was unable to establish who was behind Monday's attacks, or if there was any link to the October ones in France.
Sweden's national cybersecurity centre - which said it could not speculate on who was behind the attacks - is working on several incidents affecting grocery stores across the country, the head of the centre, John Billow, said on Monday.
"We have in recent weeks... identified we have quite a lot of exposed operational technology devices in Sweden that we have been clear about the necessity to update or patch," he said.
'RETAIL IS AN EASY TARGET'
From refrigerators and heating systems to security cameras and alarm networks, an expanding range of devices once largely mechanical can now be monitored and controlled remotely, creating new opportunities for cybercriminals.
Stephan Moelans, CEO of Belgian refrigeration firm Sabcobel, which operates Delhaize's systems, told the Belga news agency the incident was a cyberattack, with units' evaporators switched to defrost mode. Moelans' office declined to comment.
"I've been awake since 2 a.m. We've been working all night and morning to disconnect the affected units from the network," Moelans told Belga.
A spokesperson for Colruyt Group, which operates Spar stores in Belgium under a franchise system, said five shops had their fridge systems attacked.
In Ireland, food wholesaler Musgrave said that a cyber incident had affected refrigeration systems in 13 of its SuperValu stores, forcing it to remove some chilled and frozen products from sale.
"Our monitoring systems alerted us to the issue and we took immediate action," it said in a statement. "Our investigation is ongoing."
Tom Hegel, a researcher at cybersecurity firm SentinelOne, said that attacks were usually extortion, politically motivated or nation-state level operations, with the lack of financial demands in the recent supermarket cases pointing to sabotage.
"Retail is an easy target because retail chains run enormous estates of refrigeration controllers, building management systems, door access panels and point-of-sale gear," he said.
"Grocery margins are thin and stock perishes within hours, so any disruption hurts quickly and in public."
'IT'S VERY SCARY'
Privately held grocery retail group Coop told Swedish daily Aftonbladet that six of its stores had been affected by similar incidents. It did not immediately respond to a request for comment.
Carrefour said 15 stores out of its 700 in Belgium were impacted. An Estonian supermarket chain was also affected, with temperatures set to 50 C, technology supplier Kitman Coldtech told public broadcaster ERR.
Luc De Laet, founder and owner of Belgian butchery chain De Laet & Van Haver, said he was woken at 3:30 a.m. by an employee telling him there was a problem. He rushed to his store in Hove, south of Antwerp, and found the fridges turned up as high as 18 C.
He said it had ruined some €15,000 ($16,764) worth of meat.
"It's very scary. They are hacking the system that is doing the registration of the temperature, and they can program it at a distance," he told Reuters, adding it made him angry having to throw away so much food.
De Laet said he felt the hackers were trying to destabilise European economies, adding that he had contacted police but didn't know if there was an investigation.
"I only have two words for them: wake up, please, because there's something going on," he said.
($1 = 0.8948 euros)
(Reporting by Anna Ringstrom, Marie Mannes, Louise Rasmussen and Johan Ahlander in Stockholm, Helen Reid in London; Additional reporting by Padraic Halpin in Dubin, Leo Marchadon, Inti Landauro in Brussels, Dominique Vidalon in Paris; Writing by Adam Jourdan and Josephine Mason; Editing by Terje Solsvik, Kirsten Donovan and Jan Harvey)
