Freezer Cyberattacks Hit Europe’s Supermarkets but Spare Spain So Far
Hackers switched off store freezers in France, Belgium, Portugal and more, but no Spanish chain has been hit. What Catalan supermarkets say they are doing.
A wave of cyberattacks that set off defrost cycles in supermarket freezers across Europe has not reached Spain, and chains operating in Catalonia say their refrigeration systems are protected. Catalan daily Ara reported that no Spanish supermarket has had an incident so far, even where the same companies were targeted in other countries.
For shoppers in Barcelona, that means no empty freezer shelves or thrown-out stock linked to the attacks. Industry sources told the paper that the risk remains real and that most chains have plans in place to respond.
How hackers emptied freezers in France and Belgium
The first attacks hit food retailers in France, the Netherlands and Belgium in mid-October. France suffered most, with millions in losses from food that had to be discarded. Intermarché, Monoprix (part of the Casino Group), E.Leclerc and Carrefour were among the French names affected.
In Belgium, the targets included Carrefour and Intermarché, the local chains Delhaize and Spar (a Colruyt Group subsidiary), and Ikea, which also sells food. In the Netherlands, seventeen stores belonging to small food retailers were hit, along with the Albert Heijn chain.
The method focused on refrigeration. Store fridges and freezers are now connected to the internet and run remotely through software. According to the companies and official investigations in the affected countries, the attackers got into these systems and started defrost programs almost at once in dozens, sometimes hundreds, of shops. Several supermarkets said they found cold rooms at temperatures above 50 degrees, and tons of food went in the bin.
A second round reached Portugal on Nov. 2
On Nov. 2, similar incidents were reported in Estonia, Finland, Ireland, Italy, Luxembourg, Sweden, Germany and Portugal, and again in France. European Commissioner for Agriculture Christophe Hansen said: “The instrumentalization of food has become a reality.”
Spanish companies Mercadona and El Corte Inglés both operate in Portugal, and neither was attacked there. Carrefour is the only one of the hit chains with a large presence in Spain, and it has reported no incidents in the Spanish market.
What Catalan chains say about their defenses
Ametller Origen, the Penedès-based Catalan grocer, told Ara it has security measures protecting the control systems of its refrigeration units against possible cyberattacks. The group also farms and packs its own produce, which gives it a different logistics model from most rivals, and says its protections against cyber threats have been in place for a long time.
According to industry sources, every company in the sector has protected the type of refrigeration system that was targeted elsewhere. Supermarkets in Catalonia believe they are well covered. “Access, a priori, is not that easy via the internet,” those sources said. Most companies still say they need to keep updating their protection and put more resources into it.
What it means for shoppers in Catalonia
Because the attacks went through the fridge control software, part of the risk sits with the companies that supply that equipment, not only with the supermarkets. The sector expects more attacks on a European scale and accepts they could reach the Spanish market. For now, chains are concentrating on prevention.
In the countries already hit, the damage went beyond spoiled food. Stores also faced costs and harm to their reputation when regular customers arrived to find some products missing. Spanish retailers cite the same two concerns, cost and reputation, when they explain why they are guarding their refrigeration systems.
Source: Ara
