The disruption spanned nine EU member states on Monday, including Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal, and Sweden. On Tuesday, officials confirmed that four supermarkets in Germany and six in Romania were also affected. Thomas Regnier, a spokesperson for the EU, stated that bloc agencies are coordinating with national authorities to develop a joint response, emphasizing the need for collective resilience against such cyber incidents. However, Regnier declined to identify specific culprits.
Romania’s top cybersecurity official, Dan Cimpean, director of the National Cyber Security Directorate, downplayed the sophistication of the threat. Speaking to AFP, Cimpean described the attack as “semi-amateurish” and stated that authorities do not suspect a state actor is involved. He further noted that no infrastructure outside of the affected supermarkets was compromised. In Belgium, which suffered hits at dozens of stores across several grocery chains, federal prosecutors have opened an investigation.
Financial and operational impacts have been reported across multiple nations. In Italy, approximately 20 supermarkets were affected. Giuseppe Spadaro, who runs a group of 300 Coop supermarkets in Sicily, told the Corriere della Sera that four of his stores were hit, resulting in thousands of euros in damage. “We had to throw away everything. The shelves are empty,” Spadaro said. The Italian government held talks with intelligence and cybersecurity heads on Tuesday, with Prime Minister Giorgia Meloni’s office describing the impact as “limited” while maintaining a state of high alert.
In the UK, Richard Horne, chief executive of the National Cyber Security Centre, told the BBC that the issue affected the “whole food supply chain,” though the impact was minimal. He noted that hackers attempted to target small meat-processing firms, but only a couple of instances involved the exploitation of vulnerable technology. The current wave of attacks mirrors a similar incident in October that swept through hundreds of supermarkets in France and other countries.
Technical analysis indicates that legacy infrastructure played a role in the vulnerability. In Sweden, the supermarket chain Coop stated that refrigerators and freezers at seven stores were connected to “old 4G networks.” Carlos Cancinos, a Coop spokesperson, said the chain has accelerated an upgrade to move connected refrigeration equipment onto 5G networks and modern modems, a process begun after the October attacks. Danfoss, a Danish manufacturer of refrigeration controls whose systems were targeted, has been in contact with customers for three weeks, recommending that systems be removed from direct internet access.
Frank Groenewegen, a cybersecurity expert at Deloitte in The Hague, urged retailers to verify if their refrigeration controllers are connected to the internet and running the latest security updates. “If they don’t even know, then remove them from the public internet immediately,” Groenewegen told Reuters. While disconnecting systems does not fix the root cause, he noted it isolates the infrastructure, preventing further immediate exploitation by attackers. No specific deadline for a patch or regulatory step was announced, but national authorities remain on high alert.
