Hackers raised refrigerator and freezer temperatures at hundreds of French supermarkets as high as 50°C, spoiling food and causing fires, in what the Paris prosecutor’s office described as a large-scale attack on connected refrigeration. Prime Minister Sébastien Lecornu has asked the National Cybersecurity Agency (ANSSI) to investigate, and France is coordinating with European counterparts.
Carrefour said 80 of its supermarkets were affected, while Monoprix said 5 per cent of its roughly 490 French stores were hit. Les Mousquetaires, which owns Intermarché, said fridges in about 150 stores were heated to 50°C overnight for six hours, and that staff threw out all the affected food. Dominique Schelcher, chief executive of Coopérative U, said his group had also been targeted and called the attack “unprecedented”. Intermarché chief Thierry Cotillard told BFM TV that losses could reach tens of millions of euros across the country in a single day. E.Leclerc and Auchan did not respond to requests for comment.
Felix Aime, a senior analyst at Sekoia, said Spain, Portugal, Poland, Germany and Belgium were also affected. The control panels that run supermarket cold aisles can be reached over the internet so that maintenance firms can adjust them remotely. A source close to Lecornu said ANSSI had found a vulnerability in software supplied by Danish company Danfoss. Danfoss said it was aware of incidents affecting a limited number of refrigeration management systems that were running outdated firmware, and that it had long urged customers to update. On 9 August, Claroty’s Team82 published research on flaws in the Danfoss AK-SM 800A controller, which later Danfoss updates fixed. The attacks resemble disruptions at about a dozen US military commissaries in late August.
The French retail federation, the FCD, has asked Danfoss for full transparency, and some stores are already operating normally again. Christel Delberghe, director general of Eurocommerce, said the incident showed the need for resilience across the whole supply chain.
Separately, Dutch group Ahold Delhaize, which owns Albert Heijn, took several systems offline after a security issue on its network, halting grocery deliveries through its app. The company said there was no reason to link that incident to the attacks in France. Online orders make up about 10 per cent of Albert Heijn’s sales and its shops stayed open, while websites for its US chains Stop & Shop, Giant, Hannaford and Food Lion showed temporary outage notices.
