Overnight, hackers manipulated the temperatures of refrigerators and freezers in numerous French supermarkets, raising them to as high as 50 degrees Celsius (122 degrees Fahrenheit), which led to food spoilage and even caused some fires.
According to the Paris prosecutor’s office, this was a “large-scale” attack that impacted connected refrigeration systems at several major food retailers across France, resulting in significant food loss and fires.
In response to the incident, Prime Minister Sebastien Lecornu has directed the National Cybersecurity Agency of France (ANSSI) to look into the situation, as stated by a representative in his office.
It appears that France is working in collaboration with other European nations, realizing that they might face similar threats. Authorities are currently determining if additional French companies could be at risk.
Felix Aime, a senior cyber threat analyst at Sekoia Threat Detection and Research, mentioned that countries including Spain, Portugal, Poland, Germany, and Belgium have also experienced repercussions.
Carrefour reported that 80 of its stores were affected, while Monoprix, which has around 490 locations, indicated that about 5% of its stores were among those impacted.
Les Mousquetaires, the parent company of Intermarche, noted that the temperatures of fridges in approximately 150 stores reached 50 degrees Celsius for six hours overnight. A spokesperson confirmed that all compromised food was discarded to prevent health hazards.
One Paris resident, Geert de Clercq, observed employees at an Intermarche in central Paris dumping defrosted frozen foods into a large trash container, with melted ice cream spilling out of broken tubs onto the street.
Dominique Schelcher, CEO of Cooperative U, acknowledged that his supermarket group was also targeted in this incident.
“Attacking equipment crucial for preserving fresh products and ensuring the food supply for the French public is extremely serious and unprecedented,” he expressed on social media.
Retail giants E.Leclerc and Auchan didn’t reply when asked for comments on the matter.
While there’s still no precise estimate of the total losses for the industry, Intermarche’s CEO Thierry Cotillard stated on a TV segment that this “unprecedented” attack could result in losses reaching “tens of millions of euros across the country in just one day.”
Christel Delberghe, general director at the European retail association Eurocommerce, remarked that this situation highlights the critical importance of resilience throughout the entire supply chain.
Typically, supermarket cold sections are managed by control systems that handle all of a store’s fridges and freezers, accessible via the internet, allowing maintenance teams to make adjustments remotely.
A source close to Prime Minister Lecornu reported that ANSSI has identified a vulnerability in software provided by the Danish company Danfoss.
Danfoss acknowledged awareness of incidents in France involving a limited number of refrigeration management systems and noted that affected units were running outdated firmware. The company has been advising customers for some time to keep their systems up to date and to transition away from outdated systems.
On August 9, cybersecurity firm Claroty’s Team82 published findings detailing vulnerabilities in the Danfoss AK-SM 800A controller. Their report indicated that previously issued software updates addressed issues that could have allowed cyber attackers to bypass authentication controls and execute malicious code on compromised devices.
These incidents bear resemblance to similar disruptions reported at a handful of U.S. military commissaries in late August that resulted in food losses as well.
In light of the incident, the French retail association Fédération du Commerce et de la Distribution has called for “full transparency” from Danfoss regarding the situation, emphasizing that supermarkets are working to protect consumers and restore normal operations swiftly. Some affected stores have reportedly resumed their activities.
Dutch retailer Ahold Delhaize, which runs the Netherlands’ largest supermarket chain, Albert Heijn, and has significant operations in the United States, announced it was addressing a “security issue” on its network and had temporarily taken several systems offline as a precautionary measure.
A notice on the retailer’s app indicated a halt in grocery deliveries due to a “cybersecurity incident.” Online sales contribute roughly 10% to Albert Heijn’s revenue. While physical stores are still operational, it seems that rival stores have experienced an increase in online delivery requests.
Ahold Delhaize also stated there’s no evidence linking the incidents in France with their supermarkets. The company ranks as the fourth-largest grocery retailer in the U.S., with its various chains, including Stop & Shop, Giant, Hannaford, and Food Lion, displaying messages that the “site is temporarily down.”
It remains unclear if other operations have been impacted.
