Cyberattack on French Supermarkets Causes Food Spoilage and Fires

A cyberattack on refrigeration systems at hundreds of supermarkets in France has raised the temperature of fridges and freezers to as high as 50 degrees Celsius (122F), spoiling food and causing fires at several stores. Top retailers Intermarche, Cooperative U, E Leclerc, and others confirmed the cyberattack on Monday. At least 300 shops of Intermarche or its Netto brand were targeted, along with more than 100 Cooperative U outlets, according to the retailers. Carrefour reported that 80 supermarkets were affected, while Monoprix noted that about 5 percent of its roughly 490 stores were hit. E Leclerc also confirmed that several of its stores were targeted. The Paris prosecutor’s office stated that the attack had affected connected refrigerators in several major food retailers across France, leading to food losses and fires. Prime Minister Sebastien Lecornu ordered France’s National Cybersecurity Agency (ANSSI) to investigate the incident. A source in his office indicated that France was coordinating with European counterparts due to the potential for other countries to be affected, and authorities were assessing whether other French companies were at risk. There was no immediate estimate of industry-wide losses; however, Intermarche CEO Thierry Cotillard mentioned that the attack could represent losses amounting to tens of millions of euros nationwide in a single day. According to BFM TV, the hackers remotely triggered the forced defrosting of refrigeration systems in numerous stores, resulting in the destruction of stocks of fresh and frozen products. Intermarche stated that affected stores would need to discard all fresh or frozen products. Dominique Schelcher, CEO of Cooperative U, described the attack as extremely serious and unprecedented, emphasizing the need for an investigation to fully understand the incident. Supermarket cold aisles are typically managed by control panels that can be accessed over the internet, allowing maintenance companies to adjust them remotely. A source close to Lecornu noted that ANSSI had identified a vulnerability in software supplied by Danish company Danfoss. Danfoss acknowledged incidents in France affecting a limited number of refrigeration management systems, stating that the affected units were running outdated firmware and that they had long advised customers to keep their systems updated. The attack followed research published by cybersecurity firm Claroty on August 9, which described vulnerabilities in Danfoss systems that could allow attackers to bypass authentication. France’s retail federation, known as the FCD, called for Danfoss to provide full transparency regarding the situation. Some affected stores were reported to be operating again. Felix Aime, a senior cyberthreat intelligence analyst at Sekoia Threat Detection and Research, indicated that Spain, Portugal, Poland, Germany, and Belgium had also been affected. Cybersecurity analyst Steven Lachance described the attack as rare in its scale but not unprecedented, warning that vulnerabilities in internet-connected equipment could lead to further attacks. He emphasized the need for national and international measures to prevent such incidents in the future, noting that future targets could include energy infrastructure or hospitals.