During the night leading into Monday and on Monday morning, a new type of digital sabotage against Swedish grocery retail was discovered. Several physical stores within Ica and Coop have had their connected cooling and freezing systems hijacked by external actors. In Sjöbo and Tomelilla in Scania, Ica retailers discovered that the freezers had been remotely set to 50 degrees Celsius overnight, resulting in goods worth hundreds of thousands of Swedish krona having to be discarded. Similar incidents were reported on Monday from Coop stores in Gävle and Sundsvall, among others.
Hit E-commerce Hub
For competitor Axfood, which operates chains such as Willys and Hemköp, the physical stores have avoided the intrusion. However, the attack has directly hit the group's e-commerce logistics. Axfood's central consumer picking warehouse in Västra Frölunda, Gothenburg, has been subjected to the digital attack on the cooling infrastructure.
When the control systems were manipulated, the cold chain was broken at the facility where online grocery orders are picked and packed for home delivery and collection. As the food safety of chilled and frozen goods could no longer be guaranteed, operations had to be halted pending technical troubleshooting and remediation, which directly impacts customers in the region.
Since the cold chain has been broken there, we are experiencing an impact on e-commerce with home deliveries in the Gothenburg area. The intrusion occurred via an external supplier responsible for the cooling system, and there is no connection to Axfood's own systems. We take this very seriously and continue to monitor the situation," says Magnus Törnblom, Press Officer at Axfood AB, to TV4.
For the group, reliable picking warehouses are a critical piece of the puzzle, especially as Axfood's e-commerce has long been pointed out as a central future investment to meet customers' demands for smooth digital deliveries. The incident has also reached government level, where the Minister for Civil Defence, Carl-Oskar Bohlin (M), announced during the afternoon that the government and relevant authorities are following developments and are in contact with the affected businesses.
Wave of Attacks in Europe
The method used in Monday's attacks follows a clear pattern that has recently shaken European grocery retail. In mid-October, hundreds of food stores in France, Belgium and the Netherlands were hit by almost identical intrusions. In those cases, the attackers exploited vulnerabilities in internet-connected control systems for commercial refrigeration units from well-known manufacturers such as Danfoss and Copeland.
By gaining access via unprotected web interfaces or outdated software in the stores' and warehouses' operational technology, hackers were able to force extended defrost cycles and raise setpoints to 50 degrees. At the same time, the local control panels were locked with new passwords so that on-site personnel could not manually stop the heating without cutting off the main power supply.
New Frontline for IT Security
Swedish grocery retail has previously experienced how quickly a digital attack can paralyze physical sales. When the extensive Kaseya attack knocked out Coop's checkout systems in the summer of 2021, the crisis led to Coop and Ica initiating a unique collaboration at the local level to save fresh produce and help customers.
However, Monday's events mark a shift in the threat landscape against retail. Instead of locking checkout systems or business data with ransomware, the attackers are now directly targeting the physical infrastructure and supply chain. When connected cooling units at a central e-commerce warehouse can be remotely controlled and disabled from a distance, completely new demands are placed on how Swedish e-commerce companies and logistics actors secure their property and operational systems against the outside world.