The motive for the cyberattacks is unknown, and no one has claimed responsibility. A Romanian official said he did not suspect a state actor. The announcements on Tuesday came as the EU warned that the attacks were “not isolated”.
Romania’s top cybersecurity official, Dan Cimpean, director of the National Cyber Security Directorate, told the AFP news agency: “It seems semi-amateurish. We do not suspect, under any circumstances, that it is a state actor.” He added that “no other infrastructure was compromised”.
On Tuesday, officials and company representatives said four supermarkets in Germany and six in Romania were affected. The UK, which is not in the EU, was also hit. In Italy, about 20 supermarkets were affected. Giuseppe Spadaro, director of a group that runs Coop supermarkets in Sicily, said four of its 300 stores were hit, causing thousands of euros in damage. “We had to throw away everything. The shelves are empty,” he told Italy’s Corriere della Sera newspaper.
Belgium was among the hardest-hit countries on Monday, with dozens of stores across several grocery chains reporting refrigeration failures. Federal prosecutors there have opened an investigation. In Sweden, the supermarket chain Coop said that refrigerators and freezers affected overnight at seven of its stores had been connected to “old 4G networks”, and that the stores had since resumed normal operations. Carlos Cancinos, a spokesperson for the chain, said Coop had accelerated an upgrade, begun after the October attacks, to move its connected refrigeration equipment onto 5G networks and modern modems. “This helps to solve a large share of problems of this kind,” he said.
Thomas Regnier, a spokesperson for the EU, said the bloc’s agencies were talking with national authorities to develop a joint response. “These are not isolated incidents, and of course, we have to be collectively resilient and prepared for such cyber incidents,” he said. But he refused to point the finger at any potential culprits.
In the UK, hackers tried to target small meat-processing firms, but the impact was minimal, said Richard Horne, chief executive of the National Cyber Security Centre (NCSC). Horne told the BBC the issue affected “the whole food supply chain”, and that there had been a couple of instances where “vulnerable technology had been exploited”.
Italy’s government held talks with the heads of the intelligence services and the National Cybersecurity Agency on Tuesday after the attacks, and Prime Minister Giorgia Meloni’s office said the incident had a “limited” impact. “There is no cause for alarm, although all the relevant institutional bodies remain on high alert,” it said in a statement.
The second wave of attacks mirrored the cyberattack that swept hundreds of supermarkets across France in October, which also affected stores in several other European countries. Danfoss, a Danish maker of refrigeration controls whose systems were again among those targeted, said it had been in close contact with customers for the past three weeks. It recommended that the systems not be directly accessible from the internet.
Frank Groenewegen, a cybersecurity expert at Deloitte in The Hague, urged retailers to check whether their refrigeration controllers were connected to the internet and running the latest security updates. “And if they don’t even know, then remove them from the public internet immediately,” he told the Reuters news agency. “With disconnecting, you haven’t fixed the root cause, but you’ve at least isolated those systems so that an attacker is not able to do this anymore.”