A cyberattack on supermarket fridges spoils food across France
The attack affected refrigeration systems at several major retailers, forcing stores to discard food and prompting a national investigation. Researchers had previously identified vulnerabilities in a Danfoss refrigeration controller, although the precise method used in the latest incident remains unclear.
Hackers caused refrigeration systems at hundreds of French supermarket stores to heat up overnight, raising temperatures in some fridges and freezers to 50 degrees Celsius (122 degrees Fahrenheit), spoiling food and triggering fires, according to a Reuters report on Monday.
The Paris prosecutor’s office said a “large-scale” cyberattack was affecting connected refrigeration systems at several major food retailers across France, resulting in food losses and fires.
Prime Minister Sébastien Lecornu has instructed France’s National Cybersecurity Agency (ANSSI) to investigate, a person in his office said. France was coordinating with European counterparts because other countries could also be affected, the person added, while authorities were assessing whether other French companies were at risk.
Felix Aime, a senior cyber threat intelligence analyst at Sekoia Threat Detection and Research, said Spain, Portugal, Poland, Germany and Belgium had also been affected.
Carrefour said 80 of its supermarkets had been hit, while Monoprix reported that 5% of its stores were affected. Les Mousquetaires, the owner of Intermarché, said refrigeration systems at around 150 of its stores had been heated to 50 degrees Celsius for six hours overnight. A spokesperson said all affected food had been discarded to eliminate health risks.
The disruption was visible on the streets of Paris. Geert de Clercq, a Paris resident, witnessed staff at an Intermarché in central Paris throwing cartloads of thawed frozen food into a large waste container, with melted ice cream spilling from broken tubs onto the street.
Cooperative U CEO Dominique Schelcher said his supermarket group had also been targeted.
“Targeting equipment essential to the preservation of fresh products and to the food supply of the French people is of extreme gravity and is unprecedented,” he wrote on X.
E.Leclerc and Auchan did not respond to requests for comment. There was no immediate estimate of the industry-wide losses.
“Retail and wholesale play an essential role in keeping Europe supplied with the goods people rely on every day,” said Christel Delberghe, director general of European retail association EuroCommerce. “This incident underlines the importance of resilience across the entire supply chain.”
Connected refrigeration systems come under scrutiny
Supermarket refrigeration systems are typically managed through control panels that regulate an entire store’s fridges and freezers. These systems can be accessed over the internet, allowing maintenance companies to adjust settings remotely.
The person close to Lecornu said ANSSI had identified a vulnerability in software supplied by Danish company Danfoss.
Danfoss said it was “aware of incidents in France affecting a limited number of refrigeration management systems.” The affected units, it said, were running outdated firmware.
The company added that it had “long advised customers to keep supported systems updated with the latest firmware and to migrate legacy systems to current-generation solutions.”
On August 9, cybersecurity firm Claroty’s Team82 published research detailing vulnerabilities in Danfoss’s AK-SM 800A controller. According to the report, software updates released by Danfoss addressed issues that could have allowed attackers to bypass authentication controls and execute code on compromised devices.
The incidents resemble disruptions reported at about a dozen U.S. military commissaries in late August, when refrigeration problems resulted in food losses.
Dutch supermarket group reports separate security incident
In the Netherlands, Ahold Delhaize, which operates the country’s largest supermarket chain, Albert Heijn, and has major operations in the United States, said it was dealing with a “security issue” on its network. The company took several systems offline as a precaution.
A message on Albert Heijn’s smartphone app said the retailer was unable to deliver groceries because of a “cybersecurity incident.”
Online orders account for about 10% of Albert Heijn’s sales. Its physical stores remained open, while Dutch news agency ANP reported a surge in delivery orders at rival retailers.
Ahold Delhaize said there was no reason to link the incident to the attacks in France.
The company is the fourth-largest grocery retailer in the United States. Websites for its Stop & Shop, Giant, Hannaford and Food Lion chains displayed notices saying they were temporarily unavailable.
It was unclear whether other operations had been affected.
