Food products have been pulled from supermarket shelves across Europe after a suspected cyberattack campaign saw multiple grocery chains report temperature spikes on their fridges and freezers.

At least seven European countries have seen reports of temperatures soaring to as high as 70°C, with the bulk of known incidents appearing to have hit Dutch supermarket chain Ahold Delhaize.

Some 40 Delhaize supermarkets in Belgium and Luxembourg were affected according to Euronews, while BBC reported a smaller number of shops were impacted in Sweden, Ireland, the Netherlands, Estonia and Finland.

Speaking with Information Age, a spokesperson for Swedish grocer Coop confirmed seven out of its approximate 800 locations in Sweden were affected overnight into Monday (Central European Time).

“The issues ranged from complete shutdowns of refrigerators and freezers to partially functioning equipment, and in one instance, the system began to generate heat,” they said.

“The incident was quickly identified, and the situation is now localised, fully contained, and under control.”

Belgian company Colruyt – which operates Spar grocery stores in Belgium – reportedly confirmed five shops had their fridges attacked, while Swedish chain ICA confirmed that a limited number of stores were affected.

“Our refrigerators and freezers have been hacked overnight, and they have set the temperature to 50 degrees,” an ICA branch wrote on social media.

Though Delhaize reportedly described the temperature spikes as an “IT incident”, furniture and food retailer IKEA confirmed it was aware of a “cybersecurity incident” affecting retail refrigeration control systems in “many retailers across Europe”.

“We can confirm that only one IKEA location has been affected as of now, in Mons, Belgium,” IKEA told Information Age.

“Our teams are investigating to better understand the nature and scope of the incident and any potential impact on our operations.”

It started in France

Matt Warren, director of RMIT University's Centre for Cyber Security Research and Innovation, said the recent fridge hijacking incidents mirrored a separate attack campaign where up to 700 French supermarkets were affected in early October.

At the time, local media reported millions of euros worth of food was discarded as a result.

“The impact of these cyber-physical cyberattacks is that they have a real world impact in terms of the destruction of fridges and the food in them,” said Warren.

Large amounts of food have been discarded as a result of the attack. Photo: YouTube / ABC

Stephan Moelans, chief executive of Belgian refrigeration company Sabcobel, which operates Ahold Delhaize's systems and hundreds of units across Belgium, told the Belga news agency the attacks had seen hackers remotely toggle units’ evaporators to defrost mode.

The same attack method was reportedly used during the earlier attacks in France.

Alex Nehmy, field chief technology officer for Asia Pacific at cybersecurity company Dragos, said refrigeration controllers are critical infrastructure for food supply chains.

“Operational technology is invisible to many people, until it goes wrong,” Nehmy told Information Age.

“This incident shows how reliant we are on these devices to maintain our way of life.”

A wake-up call for Aussie supermarkets

Warren said the incidents served as a “wake-up call for Australian supermarkets to assess the vulnerabilities of their refrigeration systems.”

“Supermarket cold aisles are typically run by fridge control panels that manage a whole store’s fridges and can be accessed online, so maintenance companies can adjust them remotely,” Warren told Information Age.

“But if that controller system is compromised via a vulnerability an entire site can be attacked, the fridges can be controlled and, in this situation, temperatures changed to extreme temperatures.”

Warren explained that many older systems simply don’t receive security updates, meaning attackers can exploit known, unpatched vulnerabilities.

“The simplest solution is not to connect the unsupported fridges systems to the Internet, isolate them and replace them,” said Warren.

“If systems cannot be updated, do not expose fridge controllers directly to the internet – put them behind a firewall and require secure remote access.”

“Deliberate” attack on food supply

EU commissioner for agriculture Christophe Hansen said the string of security incidents marked a “deliberate attempt to disrupt our food supply chain and undermine ​consumers' confidence in it”.

“[This is] a warning that we must take seriously,” Hansen told Reuters.

"The repeated occurrence of these cyberattacks is deeply concerning."

Head of Sweden’s National Cybersecurity Center, John Billow, told Reuters it was addressing several incidents around the country, and that “quite a lot of exposed operational ‌technology devices” needed updating or patching.

When asked whether the attacks were particularly sophisticated or could involve a state-backed threat actor, Craig Costello, professor in the School of Computer Science at Queensland University of Technology, said the scale of the disruption wasn’t enough to draw conclusions.

“Poorly secured, internet-accessible control systems can be compromised using basic techniques,” Costello told Information Age.

“A weakness repeated across many installations can make a relatively simple attack scalable.”

Katrien Eggers, spokesperson for Belgium's Centre for Cybersecurity, meanwhile warned that “all IT systems” are potentially vulnerable.

“And AI can now be used to successfully exploit these weaknesses – especially by sophisticated actors," said Eggers.

“It is not known who is behind this attack, and it may never be determined.”