Seven Intermarché Stores in Portugal Lose Control of Their Fridges in What the Owner Calls a Cyberattack, and Three Throw Out Stock

Seven Intermarché supermarkets in Portugal had their fridges and freezers tampered with remotely between Sunday night and Monday morning, in what the chain's owner describes as a cyberattack on an outside contractor. Three of the seven lost stock, which is being sent for destruction. All seven stayed open, and the group says food safety was not put at risk.

The Os Mosqueteiros group, which runs the Intermarché brand in Portugal, said the incident "will have targeted an external service provider responsible for managing the refrigeration systems", according to its statement as reported by Lusa via ECO. It said it activated its procedures with the firms that maintain the equipment to limit the damage and restore normal operation. "The supply chain was not affected and all food hygiene and safety conditions are assured," the group said.

The first confirmation came from APED (the Associação Portuguesa de Empresas de Distribuição, the Portuguese retail distribution association), which told Lusa that "so far, only one member" had reported an incident of this kind, affecting seven shops, and that three of them recorded losses. Neither the group nor APED has said which stores were hit.

Police are looking into it

The Polícia Judiciária (Criminal Police) told Notícias ao Minuto that it is aware of the situation and is following it with the Centro Nacional de Cibersegurança (National Cybersecurity Centre). The police said it had not yet established "whether it was a malicious attack or not".

RTP reported that the fridges and freezers were switched off overnight and that, in some cases, temperatures may have been raised to around 30 to 40 degrees Celsius, spoiling several tonnes of food. Those details have not been confirmed by the company.

Part of a wider wave

Portugal's case follows the same pattern as attacks on supermarket refrigeration in France about three weeks ago, which RTP says affected more than 300 stores. Dozens of supermarkets in Belgium were hit between Sunday night and Monday, and shops in Sweden, Estonia, Finland, Luxembourg, Ireland and the Netherlands were also affected, according to international reports cited by Notícias ao Minuto.

The European Commissioner for Agriculture and Food, Christophe Hansen, called the repeated attacks "deeply worrying" in a written statement to Lusa, reported by RTP. He described them as a "deliberate attempt to disrupt the food supply chain" of the EU and to undermine consumer confidence in it. Food security in the EU "is not currently at risk", he said, but "the food waste and the impact on businesses are real". He said he would raise the issue with fellow commissioners at their next meeting and seek an overview of retailers' plans for this kind of incident.

A Commission spokesperson pointed to the tools the EU already has: the European cyber crisis liaison network, which coordinates the response to large-scale incidents between member states, the Cyber Resilience Act on the security of digital products, the Cyber Solidarity Act, and the NIS2 Directive, which sets cybersecurity risk rules for essential and important sectors.

What it means for shoppers

APED says the spoiled products are being sent for destruction, and the stores are trading normally. Anyone with a concern about a chilled or frozen product they bought can raise it at the store; every shop in Portugal must also keep a Livro de Reclamações (complaints book), which can be filled in on paper in the shop or online.

It is the latest in a run of cyber incidents in Portugal this autumn, after attacks that shut Ovar council's public services and copied firefighters' personal data from their national register.