EU urges action as Germany, Romania and UK report supermarket cyberattacks

Hackers raised the temperatures of refrigeration systems at supermarkets in Germany, Romania and the United Kingdom during Monday’s cyberattacks, officials said, bringing the number of European countries affected in the hacking spree to at least 11.

The announcements on Tuesday came as the European Union promised a collective response, warning that the attacks, which have spoiled tonnes of food across the continent, were “not isolated”.

The motive for the cyberattacks is unknown, and no one has claimed responsibility. A Romanian official said he did not suspect a state actor.

Problems were reported in at least nine EU countries on Monday: Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden. On Tuesday, officials and company representatives said four supermarkets in Germany and six in Romania were affected.

The UK, which is not in the EU, was also hit.

Thomas Regnier, a spokesperson for the EU, said the bloc’s agencies were talking with national authorities to develop a joint response.

“These are not isolated incidents, and of course, we have to be collectively resilient and prepared for such cyber incidents,” he said.

But he refused to point the finger at any potential culprits.

Romania’s top cybersecurity official played down the threat.

“It seems semi-amateurish,” Dan Cimpean, the director of Romania’s National Cyber Security Directorate, told the AFP news agency. “We do not suspect, under any circumstances, that it is a state actor.”

He added that “no other infrastructure was compromised”.

Belgium was among the hardest-hit countries on Monday, with dozens of stores across several grocery chains reporting refrigeration failures. Federal prosecutors there have opened an investigation.

In Italy, about 20 supermarkets were affected.

Giuseppe Spadaro, director of a group that runs Coop supermarkets in Sicily, said four of its 300 stores were hit, causing thousands of euros in damage.

“We had to throw away everything. The shelves are empty,” he told Italy’s Corriere della Sera newspaper.

Italy’s government held talks with the heads of the intelligence services and the National Cybersecurity Agency on Tuesday after the attacks, and Prime Minister Giorgia Meloni’s office said the incident had a “limited” impact.

“There is no cause for alarm, although all the relevant institutional bodies remain on high alert,” it said in a statement.

In the UK, hackers tried to target small meat-processing firms, but the impact was minimal, said Richard Horne, chief executive of the National Cyber Security Centre (NCSC).

Horne told the BBC the issue affected “the whole food supply chain”, and that there had been a couple of instances where “vulnerable technology had been exploited”.

The second wave of attacks mirrored the cyberattack that swept hundreds of supermarkets across France in October, which also affected stores in several other European countries.

In Sweden, the supermarket chain Coop said that refrigerators and freezers affected overnight at seven of its stores had been connected to “old 4G networks”, and that the stores had since resumed normal operations.

Carlos Cancinos, a spokesperson for the chain, said Coop had accelerated an upgrade, begun after the October attacks, to move its connected refrigeration equipment onto 5G networks and modern modems.

“This helps to solve a large share of problems of this kind,” he said.

Danfoss, a Danish maker of refrigeration controls whose systems were again among those targeted, said it had been in close contact with customers for the past three weeks. It recommended that the systems not be directly accessible from the internet.

Frank Groenewegen, a cybersecurity expert at Deloitte in The Hague, urged retailers to check whether their refrigeration controllers were connected to the internet and running the latest security updates.

“And if they don’t even know, then remove them from the public internet immediately,” he told the Reuters news agency. “With disconnecting, you haven’t fixed the root cause, but you’ve at least isolated those systems so that an attacker is not able to do this anymore.”