Contents
How does the hacker attack on supermarkets work?
The first big wave of the hacker attack on supermarkets hit France overnight between 11 and 12 October. The hackers broke into remote control devices made by Danish company Danfoss. Supermarkets use these devices to run their fridges and freezers. CERT-FR is France’s national cybersecurity response team. In its official alert, it confirmed “numerous compromises” of Danfoss AK-SM and AK-SC controllers. It also listed Copeland and Dixell xweb systems. According to Danfoss, most of the devices hit were old “legacy” products that no longer get software or security updates.
Once inside, the hackers changed the temperatures and started defrost cycles. As a result, the fridges warmed up. In some stores, fridges and freezers reached about 50°C. So far, nobody has named the group behind the attacks. There is also no proof that a state or a known crime group is involved.
Which countries and supermarket chains have been affected?
In France, the October hacker attack on supermarkets hit hundreds of stores, including Intermarché, Carrefour, Monoprix and Coopérative U. Then, on 2 November, a second wave struck Belgium, Sweden, Estonia, Ireland, Luxembourg, the Netherlands and Finland. The chains hit include:
- Belgium: Delhaize, Carrefour and Colruyt;
- Sweden: ICA and Coop, with some stores closed for the morning;
- Ireland: SuperValu, which took fresh and frozen food off the shelves in 13 stores as a precaution;
- Estonia: Selver;
- Finland: K-stores run by the Kesko group.
Which Italian regions have been hit?
In Italy, the Radenza Group was the first to report the hacker attack on supermarkets. It runs Coop-branded supermarkets in Sicily. Its general manager, Giuseppe Spadaro, confirmed attacks on at least four of its stores: three in Catania and one in Palermo. The attack started at about 4 a.m. on 2 November. First, the hackers started the defrost cycle from afar. Then the frozen food warmed well above its set temperature of -20°C. In the end, staff had to throw away everything in the units that were hit.
The number grew the next day. By 3 November, local press counted at least 20 supermarkets hit in Sicily, in Palermo, Catania, Ragusa and Trapani. Coop, however, said the stores it runs directly had no problems. At the same time, two other Italian firms reported cyberattacks. The first is a Tuscan catering firm, the kind that supplies school and office canteens. It told Italy’s National Cybersecurity Agency. The second is a frozen food maker in Emilia-Romagna.
How much could the hacker attack on supermarkets cost?
For now, there is no full estimate of what the hacker attack on supermarkets has cost across Europe. The first numbers mostly concern France. There, Thierry Cotillard, the head of Intermarché, spoke to BFM TV. He said losses could reach tens of millions of euros across the country in a single day.
Moreover, the costs go beyond the food that stores must throw away. Firms also have to pay to fix their IT systems, check the safety of their devices and keep their stores running. In Italy, the Radenza Group puts its own loss at several thousand euros. It also says it will spend more on cybersecurity.
What are the Italian authorities doing?
The Postal Police (Polizia Postale, Italy’s cybercrime unit) is tracing where the hacker attack on supermarkets came from. It is also checking for links with the attacks in other European countries. Meanwhile, the National Cybersecurity Agency (ACN) had already warned stores and fridge repair firms on 13 October, right after the French attacks. At the time, it told them to take these systems off the open internet. Now the agency is watching more closely. It has also reminded food stores, logistics firms and cold storage operators of its main advice:
- keep control systems apart from company networks;
- protect remote access with a VPN and two-step login;
- replace devices that no longer get support.
On 3 November, undersecretary Alfredo Mantovano chaired an urgent meeting at Palazzo Chigi. Mantovano oversees the intelligence services. The heads of the ACN and of Italy’s home and foreign intelligence agencies – AISI and AISE – took part. In addition, COPASIR, the committee of Parliament that oversees the intelligence services, has asked for information.
What it means for shoppers
The hacker attack on supermarkets targeted store equipment, not customers. In fact, none of the reports so far mention any impact on payment cards or personal data. The stores hit threw away the food from the units involved or, as in Ireland, took it off the shelves as a precaution. According to EU Farm Commissioner Christophe Hansen, food safety is not at risk right now. However, the food waste and the damage to firms are real. So, if you see empty freezer shelves or a closed store in the coming days, this may be the reason.
For families, payment and data breaches remain the more likely online risks, as the recent Revolut hacker attack showed. To spot the most common tricks, read our guide Online Scams: How to Protect Yourself from Digital Fraud. And if you’re keeping an eye on your shopping bill, see How to Manage Groceries and Shopping on a Budget in Italy.
