French supermarket cyberattack turns freezers into ovens

The French supermarket cyberattack started overnight, when hackers took control of connected refrigeration systems in hundreds of stores and forced freezers and fridges up to 50 degrees Celsius (122 Fahrenheit), a temperature that spoiled fresh and frozen stock and set off fires in some units. The Paris prosecutor's office called it a large-scale attack on connected refrigerators at several major food retailers across France, according to Reuters, and opened an investigation after stores reported food losses and fires. The intrusion happened during the night from Sunday into Monday, when the stores were empty and no staff were there to notice the warming.

The chains hit hardest

The French supermarket cyberattack hit Intermarche the hardest. Les Mousquetaires, the group that owns the retailer, said refrigerators in around 150 of its stores were pushed to extreme heat for about six hours overnight. A spokesperson said the company discarded all the affected food to remove any health risk. In central Paris, a Reuters reporter watched staff at one Intermarche wheeling cartfuls of defrosted frozen food into a giant trash container, with molten ice cream sloshing out of broken tubs on the street.

Carrefour said 80 of its supermarkets were hit, a small slice of its 6,000 stores nationwide. Monoprix said about five percent of its roughly 490 stores were affected. Dominique Schelcher, the chief executive of Cooperative U, confirmed on X that his group had been targeted as well, calling the attack extremely serious and unprecedented. E.Leclerc and Auchan did not respond to requests for comment.

How the hackers did it

Attackers seized refrigeration management software made by the Danish manufacturer Danfoss and forced the systems into continuous defrost mode, according to an analysis by cybersecurity publication CyPro. Defrost cycles normally run for short bursts overnight to clear ice from the coils. This time the heaters stayed engaged for hours, turning freezers into warming cabinets while the stores sat dark. Because the attack ran while the buildings were empty, no one was hurt. The method the attackers used to get into the controllers is still unknown, and no group has claimed responsibility.

One security researcher found thousands of Danfoss controllers reachable over the internet, with about 1,590 of them in France, a sign of how much of the country's cold chain runs on connected equipment. Retailers have spent years linking their equipment so technicians can monitor temperatures remotely, and that convenience gave the attackers a single point of entry. There is no confirmation that a public vulnerability or a leaked proof of concept was used in this French supermarket cyberattack, and the full picture is still forming.

The fallout is spreading across Europe

France is not the only country affected. Felix Aime, a senior cyber threat intelligence analyst at Sekoia Threat Detection and Research, said Spain, Portugal, Poland, Germany and Belgium had also been hit. Dutch supermarket operator Ahold Delhaize, which owns the Netherlands' biggest chain Albert Heijn and ranks as the fourth-largest grocery retailer in the United States, said it was dealing with a security problem in its network and took several systems offline as a precaution.

Prime Minister Sebastien Lecornu ordered France's National Cybersecurity Agency, ANSSI, to investigate, a person in his office said. France is coordinating with European counterparts because other countries could also be affected, and authorities are assessing whether other French companies are at risk. The prime minister's office did not name a suspect, and investigators have not said whether they believe the intrusion was criminal extortion, sabotage or something else entirely.

Cooperative U chief executive Dominique Schelcher said on X that "targeting equipment essential to the preservation of fresh products and to the food supply of the French people is of extreme gravity and is unprecedented." Industry coverage puts the damage at potentially millions of euros, between the discarded stock and the cost of repairs. Stores spent Monday clearing the ruined food and restocking their cases, while investigators tried to trace how the attackers got in. For shoppers, the immediate cost is spoiled stock and closed freezer aisles; for the industry, the French supermarket cyberattack is a warning that the systems keeping food cold are now part of the attack surface.

Source: CyPro analysis of the supermarket refrigeration cyberattack, reporting from Reuters.