Catalan supermarkets, for the moment immune to cyberattacks

BarcelonaA good handful of European countries have suffered cyberattacks on supermarket chains in recent weeks. Spain, however, is currently immune to these types of cyber operations, which authorities in the European Union and the affected states frame within the context of hybrid warfare, as are the attacks on blood banks in France.

The first cyberattacks took place against distribution chains in France, the Netherlands, and Belgium in mid-October. On that occasion, France was the most affected country—it is also the most populous and, therefore, has the most establishments and larger companies—with millions in losses in food that had to be thrown away. Major names in the sector suffered attacks: Intermarché, Cooperative, Monoprix—part of the Casino Group conglomerate—, E.Leclerc, and Carrefour. The latter is the only company that also operates on a large scale in the Spanish market, but it has not had any incidents in the State, just like the rest of its competitors.

Likewise, the large Belgian groups recorded attacks: the French Carrefour and Intermarché, which also have a presence in Belgium, as well as the local Delhaize and Spar—a subsidiary of Colruyt Group—and even the Swedish furniture giant Ikea—also known for selling food—recorded attacks. In the Netherlands, the cyber offensive affected seventeen establishments of small companies in the food retail sector, as well as the Albert Heijn chain.

The attacks focused, above all, on the stores' refrigeration systems. Nowadays, the chains' freezers and refrigerators are connected to the internet and are controlled remotely through software. According to what the companies and official investigations underway in the various affected states said, the hackers managed to enter these systems and activate defrost options almost simultaneously in freezers in dozens or, in some cases, hundreds of stores. Several supermarkets claimed they had found refrigerated rooms at temperatures above 50 degrees, which forced them to throw away tons of food, taking into account the economic losses this entails and the image and reputation problem that occurs when customers find a shortage of certain products when they go to shop at their regular supermarket.

Days later, on November 2nd, similar episodes were repeated in Estonia, Finland, Ireland, Italy, Luxembourg, Sweden, Germany and Portugal and they returned to France. "The instrumentalization of food has become a reality," asserted the European Commissioner for Agriculture, Christophe Hansen.

The procedures were the same: accessing online-connected refrigeration systems and starting defrost programs in refrigerators and freezers. In the case of Portugal, Spanish companies such as Mercadona and El Corte Inglés operate there, but none of them suffered attacks.

No impact in Spain

Unlike neighboring countries, for the time being, supermarkets in Spain have not suffered any impact. Among companies in the sector, there is a conviction that hacker attacks are a phenomenon that "seems to be on the rise." "It is a risk that exists and is worrying," point out industry sources, which is why the majority of chains have plans to deal with it.

The fact that these are hacks on the software of refrigerators means that part of the risk does not fall directly on the chains, but on the suppliers of these devices. Despite this, although the sector assumes that there may be new attacks on a European scale and that they could possibly affect the national market, for the moment they are limiting themselves to preparing to avoid them.

"We have security measures in place to protect the control systems of our refrigeration facilities against possible cyberattacks," point out sources from the Catalan company Ametller Origen. The Penedès-based group, which has a different logistics model than most of its competitors because it integrates a large part of the entire production chain – that is, it is at the same time a supermarket chain, an agricultural producer, and a packer – has security mechanisms "implemented for a long time" to face cyber threats.

In fact, all companies in the sector have "protected" the refrigeration systems that have been subject to attack, since the entire distribution industry is "aware" of the possibility of suffering an aggression comparable to that of supermarkets throughout Europe and, at the same time, of the problems it would entail for them in terms of costs and reputation.

Despite the risk, among the supermarkets operating in Catalonia, there is the conviction that they are well protected. "Access, a priori, is not that easy via the internet," indicate industry sources regarding these electronic protection methods and the possibility of cyberattacks on store refrigeration. Nevertheless, most companies assure that, in the current context, it is necessary to continue updating and allocating more resources to protection against piracy.