Irish and European authorities working together to investigate cyberattacks on supermarkets

Garda HQ and the National Cyber Security Centre are investigating if the attack was a ‘test run’ for future ransom demands or if a hostile state was behind it

An employee cleans an empty refrigerator at a SuperValu supermarket where refrigeration systems limited to a specific model in 13 of its 223 stores were affected by a cyber incident on Monday. Picture: REUTERS/Stringer

Irish authorities are “engaging extensively” with European counterparts in relation to the spate of cyberattacks on supermarkets across nine EU countries.

Garda HQ is understood to be assisting the National Cyber Security Centre (NCSC) in the investigation here regarding the hacking of refrigeration units at 13 Supervalu stores.

They are investigating if the attack was a ‘test run’ for future ransom demands or if a hostile state was behind it — or a mixture of both.

A total of nine countries were hit by seemingly co-ordinated cyberattacks on November 2 that turned off freeze settings, including Belgium, Estonia, Finland, Ireland, and Italy.

“It is unclear at the moment if the cyberattack [on Supervalu and other supermarkets] is a testing of systems as part of a ransomware intent or hostile states or, indeed, a bit of both,” one security source said.

“There is extensive international engagement as part of the investigation.” 

This week’s attack comes three weeks after a cyberattack disrupted some 700 French grocery stores.

Cyber agencies in Ireland and the EU have pointed to a rising prevalence in so-called “hacktivist activity”, in which cyberattacks are linked to a wider political or social issue.

Both the NCSC and the EU Cyber Agency ENISA have highlighted that cyber groups linked to states — such as Russia, China and others — are engaging in cyberattacks under the “guise” of hacktivism.

Co-ordinated cyberattacks on supermarkets fits the intent of hostile states — disrupt lives in democratic societies, interfere with essential services, such as access to food, and undermine people’s confidence in their state.

It also, as coverage has shown, results in significant media, social media and political attention, domestically and at EU level.

At the European Commission press briefing on Tuesday, spokesman Thomas Regnier said two meetings had been held, the first was between the EU Interinstitutional Task Force, with ENISA and Europol. 

The second, co-ordinated by EU Cyclone, was a meeting with member states and national authorities, including those affected. He said it is important for member states to share what happened and discuss how to respond collectively.

“These incidents show once again how cyberattacks can disrupt essential services and affect citizens’ daily lives,” he said.

Asked about possible Russian involvement, he said he had to be extremely careful about attribution, but added: “These are not isolated incidents and of course we have to be collectively resilient and prepared for such cyber incidents.” 

In Britain, its cyber security agency said the UK meat processing industry had been hit in a cyberattack.

• Cormac O’Keeffe, security correspondent