The European Commission brings together EU agencies and national authorities after attacks on refrigeration systems in stores

Two meetings with ENISA, Europol and national authorities aim to coordinate the response to incidents that disrupted refrigeration in stores across several countries. Some retailers withdrew food from sale. Investigations remain national, and the Commission has not attributed the attacks to a state or group.

On 3 November, the European Commission convened two meetings with EU agencies and national authorities to coordinate the response to cyber incidents affecting the refrigeration systems of stores in several European countries. The announcement comes after disruptions reported overnight from Sunday to Monday, which forced some retailers to withdraw food products. The investigations are being led by national authorities, and the Commission has not attributed the attacks to a state or group.

In brief

1.The first meeting included ENISA, Europol and the Commission services; the second took place through EU-CyCLONe, the network of national authorities that manage cyber crises. The aim is to exchange information and coordinate the response.

2.Operators reported incidents at dozens of stores. Reuters indicates, among others, 15 Carrefour stores in Belgium, five Spar stores belonging to the Colruyt group, seven Coop stores in Sweden and 13 SuperValu stores in Ireland. These figures do not constitute an official European tally.

3.CERT-FR warned in October about the compromise of refrigeration control equipment. The authority recommends protecting remote access and checking the configuration, including defrosting programs.

4.The Commission has not attributed the attacks to a state or organization. The meetings do not replace national investigations and do not establish that the incidents in different countries have the same perpetrator.

5.Disruption of refrigeration can lead to the loss of stock even if the store remains open. The available information does not establish the total value of the damage or a general interruption of the European food supply.

Thomas Regnier, the Commission spokesperson for digital affairs, confirmed the two meetings at Tuesday’s press briefing. The first took place in the morning, within the European interinstitutional group, with the participation of the EU Agency for Cybersecurity, ENISA, Europol and the relevant Commission services. The second, organized later that same morning with EU-CyCLONe, brought together national authorities, including those from the affected states.

The discussions aim to provide authorities with information about what happened and facilitate a collective response to incidents that extend beyond the borders of one state. Regnier emphasized the effects that cyberattacks can have on services used daily by citizens. The Commission has not announced that it is taking over the investigations or the results of a single European inquiry.

The Reuters report describes problems at several dozen Delhaize stores in Belgium and Luxembourg, at 15 Carrefour stores and five Spar stores belonging to the Colruyt group in Belgium. In Sweden, Coop indicated that seven locations were affected, while in Ireland Musgrave reported disruptions at 13 SuperValu stores. Several operators withdrew refrigerated or frozen products; some stores were able to continue operating.

These are company reports, not a complete European inventory. The number of stores alone does not show how many facilities were compromised, how much merchandise was lost or the value of the damage. The Commission has not presented a consolidated tally. Nor was the reference to five or six countries, made by a journalist at the briefing, validated by Regnier as an official total.

In Belgium, the Federal Prosecutor’s Office opened an investigation, its spokesperson confirmed to Belga. The investigation concerns reported disruptions to refrigeration systems in stores. At that time, the authorities had not announced conclusions about the perpetrators or the complete method of compromise.

The technical stakes extend beyond the operation of an individual refrigerator. Commercial systems can be monitored and controlled remotely: they manage temperatures, alarms and defrosting cycles. If access to these controls is compromised, changing the settings can affect food preservation without the physical equipment being destroyed. Checking the products and safely restoring operations remain the responsibility of operators and competent authorities.

A relevant warning already existed in France. In an alert issued in October, CERT-FR reported numerous compromises of Danfoss equipment from the AK-SM and AK-SC series, as well as Copeland xweb and Dixell xweb. The document concerns refrigeration control equipment and does not publicly identify a perpetrator of the campaigns.

The French authority recommends removing direct exposure of administration interfaces on the internet, checking the entire configuration, including defrosting programs, and restoring access through a secure VPN or protected network. The measures include updates and changing default passwords. For vulnerable equipment that remains exposed, simply resetting it does not prevent a new compromise.

The alert explains why access to refrigeration systems must be protected. It does not demonstrate that all the incidents in November exploited the same vulnerability or were carried out by the same group. Similarity between the observed effects is not sufficient to establish a link between two attacks.

Asked about the possibility of a state-sponsored operation, with Russia mentioned in the question, Regnier declined to attribute it from the Commission’s podium and referred to the ongoing national investigations. He did not confirm any demonstrated link to the French incidents in October.

EU-CyCLONe is the cooperation network of national authorities responsible for managing cyber crises. Launched in 2020 and formalized through the NIS2 Directive, it supports information exchange and joint assessment of large-scale or cross-border incidents. ENISA provides its secretariat. The network facilitates operational coordination, while fact-finding and the determination of criminal liability remain within the remit of investigative authorities.

Regnier also cited NIS2, the Cyber Resilience Act and the Cyber Solidarity Act as examples of instruments through which the EU supports resilience and cooperation. Referring to these acts does not amount to announcing the activation of all their mechanisms for the incidents in the stores. The Commission confirmed the meetings and contact with the Member States, without declaring a European cyber crisis at the briefing.

For retailers, restoring refrigeration and checking the safety of stocks are the immediate emergencies. For authorities, the extent of the damage, the access methods used and any links between the incidents remain to be determined. European cooperation can help compare information, but it does not replace these technical and judicial checks.

https://2eu.brussels/ro/news/comisia-europeana-coordoneaza-raspunsul-la-atacurile-cibernetice-asupra-instalatiilor-frigorifice-din-supermarketuri