Cyberattack Hits French Supermarkets, Spoiling Food and Causing Fires

A cyberattack targeting the refrigeration systems of hundreds of supermarkets across France pushed fridge and freezer temperatures up to 50°C, spoiling food and triggering fires at several stores. Leading retailers including Intermarche, Cooperative U, E Leclerc and others confirmed the "unprecedented" attack on Monday.

According to information retailers gave AFP, at least 300 stores belonging to Intermarche or its Netto brand were targeted, along with more than 100 Cooperative U stores. Carrefour said 80 of its supermarkets were affected, while Monoprix reported that about 5% of its nearly 490 stores were hit. E Leclerc also confirmed some of its stores were targeted.

The Paris prosecutor's office said the "large-scale" attack affected "connected refrigerators at numerous major food retailers across France." The result was spoiled food and fires, the office added.

The incident prompted Prime Minister Sebastien Lecornu to direct France's national cybersecurity agency, ANSSI, to investigate. A source in the prime minister's office told Reuters that France is coordinating with European partners because other countries may also be affected. Authorities are also assessing whether other French companies are at risk.

An 'unprecedented' attack

There was no immediate estimate of industry-wide damage, but Intermarche chief executive Thierry Cotillard told BFM TV the "unprecedented" attack could cause damage amounting to "tens of millions of euros nationwide in a single day."

According to BFM TV, hackers "remotely triggered forced defrost mode in the refrigeration systems at multiple stores." This led to "the destruction of entire stocks of fresh and frozen products."

Intermarche told AFP that affected stores would have to "throw away all" fresh and frozen products.

Dominique Schelcher, chief executive of Cooperative U, said the attack had disrupted refrigeration systems since Sunday night. Writing on X, he said: "Targeting equipment essential for preserving fresh products and the food supply for the French people is extremely serious and unprecedented. This is unacceptable."

He said the company's teams were working to restore normal operations as quickly as possible, and that an investigation was needed to "fully shed light on this attack."

Supermarket refrigeration aisles are typically run by control panels that manage all of a store's fridges and freezers and can be accessed over the internet, allowing maintenance companies to adjust them from anywhere.

A source close to Prime Minister Lecornu said ANSSI had identified a vulnerability in software supplied by Danish company Danfoss. Danfoss said it was "aware of incidents in France affecting a limited number of refrigeration management systems."

The affected devices "were running old software," the company said, stressing that it had "long advised customers" to update their systems and replace outdated equipment.

The attack came after cybersecurity firm Claroty published research on August 9 describing vulnerabilities in Danfoss systems that could allow attackers to bypass authentication.

The French retail federation, known as FCD, called on Danfoss to provide "full transparency." FCD said some affected stores had resumed operations.

Felix Aime, a senior cyber threat intelligence analyst at Sekoia Threat Detection and Research, told Reuters that Spain, Portugal, Poland, Germany and Belgium were also affected.

The incident echoes an event in late August at about a dozen US military stores, where problems with refrigeration systems led to food losses.