A significant cyberattack on November 11-12 raised the temperatures in the refrigerators and freezers of numerous supermarkets across France to 50 degrees Celsius (122 degrees Fahrenheit), leading to food spoilage and fires, according to reports.
The Paris prosecutor’s office announced on Monday that the incident involved “a large-scale attack” that impacted internet-connected refrigerators in several major grocery chains throughout France, resulting in considerable food loss.
French Prime Minister Sebastien Lecornu has ordered the National Cybersecurity Agency (ANSSI) to investigate the attack. Sources indicate that agencies in France are collaborating with their European counterparts, as other countries may also be affected, while authorities assess whether additional French companies are at risk.
Felix Aime, a senior analyst for Sekoia Threat Detection and Research, noted that Spain, Portugal, Poland, Germany, and Belgium have also been impacted.
Carrefour reported that 80 of its stores were affected, while Monoprix, which operates approximately 490 stores in France, indicated that 5% of its locations experienced the cyberattack. Les Mousquetaires, the owner of the Intermarché chain, confirmed that refrigerators in around 150 of its stores heated to 50 degrees Celsius for six hours overnight, leading to the disposal of all affected food products to mitigate health risks.
Witness Geert de Clercq observed Intermarché employees in central Paris throwing away carts full of thawed frozen food into a large waste container, with melted ice cream spilling onto the street from broken boxes.
Dominique Schelcher, CEO of Cooperative U, stated that his supermarket group had also been targeted. He described the attack as a “very serious and unprecedented” act against essential equipment for preserving fresh products and supplying food to the French population.
Food retailers E.Leclerc and Auchan did not respond to requests for comments, according to Reuters. While there was no immediate estimate of the total losses for the food sector, Thierry Cotillard, head of Intermarché, stated that the “unprecedented” attack could result in national losses of “tens of millions of euros in a single day.” Christel Delberghe, CEO of the European retail association Eurocommerce, emphasized the importance of resilience throughout the supply chain.
Internet-Controlled Refrigeration Units
The refrigerators in supermarkets are typically managed by control panels that oversee the cooling systems for the entire store and can be accessed remotely, allowing maintenance companies to adjust them from anywhere.
A source close to Prime Minister Lecornu revealed that ANSSI identified a vulnerability in the software provided by the Danish company Danfoss. Danfoss acknowledged being aware of incidents in France affecting a limited number of refrigeration management systems, noting that the impacted units “were running outdated firmware” and have long recommended that clients keep their systems updated with the latest firmware and migrate older systems to newer solutions.
A study published on August 9 by the cybersecurity firm Claroty detailed vulnerabilities in the Danfoss AK-SM 800A controller. The report indicated that software updates released by Danfoss addressed issues that could have allowed attackers to bypass authentication controls and execute code on compromised devices.
These attacks are reminiscent of outages reported at over ten U.S. military stores in late August, which resulted in food losses after refrigerators were compromised.
The French retail association, Fédération du Commerce et de la Distribution (FCD), has called for “full transparency” from Danfoss regarding the incident, stating that supermarkets are working to protect consumers and return to normal operations as soon as possible. Some affected stores have already resumed activities.
Security Issue in the Netherlands
Dutch retailer Ahold Delhaize, which operates the largest supermarket chain in the Netherlands, Albert Heijn, announced it is facing a “security issue” in its network and has disconnected several systems as a precaution. A message displayed on the retailer’s smartphone app indicated that food deliveries were not possible due to a “cybersecurity incident.”
Online orders account for approximately 10% of Albert Heijn’s sales. Physical stores remained open, while rival retailers reportedly experienced a significant increase in delivery orders. Ahold Delhaize stated that there was no reason to link the incidents in France to its supermarkets.
Ahold Delhaize is the fourth largest food retailer in the U.S., with its chains including Stop & Shop, Giant, Hannaford, and Food Lion displaying messages indicating that “the site is temporarily unavailable.” The extent of any impact on other operations remains unclear.
