Cyberattacks on supermarkets sound the alarms in Brussels: "They are not isolated incidents"

BarcelonaThe wave of cyberattacks against supermarket cooling systems continues to spread and, after affecting chains in Portugal this morning, it now counts eight affected countries. Faced with this scenario, the European Union has argued that they should not be treated as isolated incidents and that a joint response must be prepared.

"Without a doubt, these are not isolated incidents, and we must collectively strengthen our resilience and preparedness against these types of cyber incidents," asserted European Commission spokesperson Thomas Regnier, who insisted on the gravity of the events. "They once again highlight how cyberattacks can disrupt essential services and affect the daily lives of citizens," he warned.

Brussels has convened two coordination meetings this Tuesday to address the cyberattacks, which on Monday at dawn surprised food establishments in Belgium, Sweden, the Netherlands, Luxembourg, Ireland, Finland and Estonia. The first brought together European bodies working on cybersecurity and the fight against crime, such as ENISA and Europol, and the second was held within the framework of EU-CyCLONe, with member states and national authorities of the affected countries. The objective, they state, is to "share information about what happened and study how we can provide the best collective response."

Prudence regarding authorship

For now, Brussels has wanted to show itself to be "extremely cautious" and has avoided attributing responsibility to any state actor, such as Russia. This, the spokesperson insisted, falls to the national authorities that are carrying out the relevant investigations. Nevertheless, they have remarked that the EU is "prepared" to face more attacks of this kind.

The latest incident has taken place in Portugal, where seven establishments of the Intermarché chain have suffered failures in cold storage management, which has caused the loss of goods in at least three of them. A coordinated cyberattack against refrigeration systems has forced the disposal of tons of fresh and frozen food.

As the Mosqueteiros Group, to which the Portuguese chain belongs, has explained, the attack was not directed directly against the stores, but rather against an external supplier in charge of the maintenance and management of the refrigeration equipment. The company has activated an emergency plan to restore the operation of the facilities, and ensures that the food safety of the rest of the products has not been compromised. The Citizens for Cybersecurity (CpC) collective has requested urgent audits of large retail distribution, and has warned that many refrigeration systems remain directly exposed to the internet without adequate protection.

'Modus operandi'

The episode in Portugal is not an isolated case, but rather follows a pattern very similar to that detected in countries such as Belgium, Sweden, Luxembourg, Ireland, Finland, Estonia, and the Netherlands. In many of these cases, hackers managed to manipulate electronic controllers remotely to change the temperature of the freezers and make it climb to levels of 50 degrees, which turned the cold storage rooms into true ovens. The attack has affected major international brands, such as Delhaize, Carrefour, Spar, the Swedish ICA and Coop, or even Ikea stores, with millionaire economic losses and the mobilization of refrigerated trucks to save the merchandise.

This modus operandi had already been seen two weeks ago in France, where the cybersecurity agency issued a general alert upon detecting intrusions into the management interfaces of refrigeration companies such as Danfoss and Copeland. Although the authorities and local police keep several criminal investigations open, the authorship of the acts remains a mystery.

The European Commissioner for Agriculture and Food, Christophe Hansen, has shown his concern regarding the repetition of these episodes, which he has described as a deliberate attempt to damage the food supply chain and generate distrust among consumers. The European Union is already coordinating information between member states to strengthen digital defenses in their basic infrastructures.