France Orders Cybersecurity Probe After Cyberattack Disrupts Refrigeration at 480 Stores

Supermarkets

France has ordered a national cybersecurity investigation after a major attack disrupted internet-connected refrigeration systems at supermarkets, raising temperatures in hundreds of stores and damaging fresh and frozen food.

The attack affected refrigeration equipment used by several major food retailers, according to the Paris prosecutor’s office, which described it as a large-scale cyberattack.

Refrigerators reached 50°C

More than 480 stores were affected, with the temperature of some refrigerators and freezers rising to as much as 50°C.

French media reports said hackers placed the refrigeration systems of several stores into defrosting mode, causing fresh and frozen food to spoil.

The attack also led to fires at several stores, according to reports cited in the coverage.

The incident was unusual because the systems targeted were responsible for keeping food cold, rather than being described only as conventional office or retail networks.

The connected refrigeration systems controlled the temperature of food stored across a large number of supermarkets.

When those settings were changed, food that required refrigeration or freezing was exposed to temperatures at which it could no longer be kept safely, according to the reports.

The affected retailers discarded food to avoid health risks.

The total financial loss across France’s retail sector had not yet been calculated.

However, Thierry Cotillard, CEO of Intermarche, said the attack could cause losses of several crore euros across the country in a single day.

Intermarche told AFP that affected stores would have to throw away all spoiled fresh and frozen products.

Investigation ordered by France

French Prime Minister Sebastien Lecornu ordered the country’s national cybersecurity agency, ANSSI, to investigate the incident.

The Paris prosecutor’s office said the attack affected internet-connected refrigerators used by several major food retailers across France.

The office described the incident as a large-scale attack and said the damage included spoiled food and fires.

France is also working with other European countries to determine whether companies in those countries were affected.

The involvement of European counterparts reflects the possibility that the same kind of refrigeration equipment or software may have been used beyond France.

The investigation is examining how attackers reached the refrigeration systems and changed their operating settings.

ANSSI has begun a detailed investigation into the incident, according to the reports.

The available reports did not establish who carried out the attack.

They also did not state that a particular group had claimed responsibility.

How the connected systems were targeted

Supermarket refrigerators and freezers are generally operated through control panels that manage the store’s cooling systems.

Because these panels are connected to the internet, maintenance companies can change their settings remotely.

If an attacker gains access to such a system, the attacker can change the settings of refrigerators and freezers.

The attack can involve exploiting a weakness in the system’s security.

A successful intrusion can reduce cooling or start the defrosting process.

Defrosting is the process through which ice accumulated inside a refrigerator or freezer is melted.

In the incident under investigation, reports said several systems were put into defrosting mode, while temperatures in affected units rose sharply.

The reports did not say that every connected refrigeration unit in France was affected.

They instead described an impact across several retailers and hundreds of stores, with the extent varying between companies.

Software weakness under examination

An official in the prime minister’s office said France’s cybersecurity agency had identified a weakness in software made by the Danish company Danfoss.

The company’s systems are used to control supermarket refrigerators and freezers.

Danfoss said it was aware of incidents involving refrigeration systems in France.

The company said the affected systems were using an older version of its software.

A separate report identified the refrigeration controller as Danfoss’s AK-SM 800A and said attackers exploited weaknesses in outdated software to gain remote access through the internet.

That account was described as part of the early reporting on the incident, rather than as a final finding from the investigation.

Danfoss said it had been advising customers for a long time to keep their software updated and replace old equipment.

The company’s statement linked the reported incidents to systems that had not been brought up to date.

The reports did not say whether all affected retailers were using the same software version or whether every affected unit was made by Danfoss.

The investigation will determine how the reported weaknesses were used and how many systems could be reached through them.

Earlier warning about vulnerabilities

Cybersecurity company Claroty released a report on 9 August about some weaknesses in Danfoss’s systems.

The report said attackers could use those weaknesses to access the systems without proper identity verification.

That finding is significant because the supermarket systems could be managed remotely through internet connections.

The reports did not establish that the vulnerabilities described by Claroty were definitively used in every incident reported in France.

They said the possibility was being examined as part of the early account of how the attack may have happened.

The French retail organisation FCD has demanded that Danfoss make complete information about the matter public.

The demand comes as retailers assess the scale of food losses and the effect on refrigeration equipment.

The reports did not provide a final technical explanation of how the attackers entered each store’s system.

Retailers report different levels of damage

Le Mousquetaires, the retail group that owns the Intermarche brand, said about 150 of its stores were hit.

The refrigeration units at those stores were heated to 50°C for six hours, according to the company.

The company’s spokesperson said all food at risk was thrown away to prevent health-related dangers.

Intermarche told AFP that fresh and frozen products spoiled by the incident would have to be discarded.

The reports did not provide the total weight or value of the food destroyed at the affected Intermarche stores.

Carrefour said 80 of its supermarkets were affected by the cyberattack.

The reports did not state that all Carrefour stores were affected.

Monoprix reported that 5% of its stores were hit.

The figures show that the disruption was not uniform across the retail sector.

Some chains reported large numbers of affected stores, while another said most of its network was not affected.

The scale of damage at each location depended on the refrigeration systems affected and the food stored in them.

Cooperative U reports problems

Dominique Schelcher, CEO of Cooperative U, said the company had been experiencing problems with its refrigeration systems since Sunday night.

A separate report said Cooperative U was among the supermarkets affected by the attack.

The company reported that 80 of its supermarkets were affected.

It also said most of its 6,000 stores were not affected.

Schelcher described the targeting of systems used to preserve fresh food and deliver food and drink to people as extremely serious.

He called the attack unacceptable and said such an attack had never happened before.

The report did not say whether all 80 affected Cooperative U supermarkets experienced the same temperature rise or the same level of food loss.

It also did not provide a separate estimate of the company’s financial loss.

Food safety and retail losses

The immediate consequence for retailers was the disposal of fresh and frozen food.

Food was thrown away because the rise in temperature created health-related concerns.

The reports did not identify the specific products discarded at each store.

They also did not provide a complete figure for the value of the food lost across all retailers.

Intermarche’s CEO said the total loss for the sector could reach several crore euros in one day.

That was an estimate, not a final accounting of the damage.

The final cost will depend on the number of stores affected, how long the refrigeration systems remained outside their normal settings and how much food each store had to discard.

The sources did not provide a confirmed total for any of those categories.

The attack therefore affected both digital systems and the physical operation of supermarkets.

A change made through a connected control system was followed by spoiled food, discarded stock and fires at some locations.

Possible impact beyond France

Cyber-threat intelligence agency Sekoia said similar activity had been observed in Spain, Portugal, Poland, Germany and Belgium.

The report did not state that the same number of stores or the same retailers in those countries had been affected.

France was investigating the possibility that companies in other European countries had also been hit.

The reports therefore connected the French incident to a wider European concern involving connected refrigeration systems.

The Dutch supermarket chain Ahold Delhaize also shut down its home-delivery application after security problems appeared in its network.

The company said it had closed several systems as a security measure.

Its smartphone application told customers that it was unable to deliver groceries because of a cybersecurity incident.

Ahold Delhaize operates Albert Heijn, described in the reports as the Netherlands’ largest supermarket chain, and also has extensive business in the United States.

Online orders account for about 10% of Albert Heijn’s sales, according to the report.

The sources did not say that Ahold Delhaize’s home-delivery disruption was caused by the same intrusion as the French refrigeration incident.

They reported the Dutch security problem separately while noting that other countries and companies could also be affected.

Earlier reports of similar refrigeration problems

Reports also said that similar refrigeration problems had been recorded at American military bases at the end of August.

The available material did not establish whether those problems were linked to the French supermarket attack.

It also did not identify the systems, software versions or number of sites involved in the American incidents.

The reference to those earlier problems adds to the concern around internet-connected refrigeration equipment, but does not by itself establish a common attacker or common vulnerability.

Those links remain matters for technical investigation.

What is known and what remains unclear

The reported facts establish that several French supermarket chains experienced problems with connected refrigeration systems.

Temperatures in affected units reached as high as 50°C, and some systems were reportedly placed in defrosting mode.

More than 480 stores were reported to have been affected, while individual retailers gave separate figures for their own networks.

Fresh and frozen food was discarded because of health-related concerns, and fires were reported at several stores.

France’s prime minister ordered ANSSI to investigate, and the Paris prosecutor’s office classified the incident as a large-scale cyberattack.

The suspected role of outdated Danfoss software and the AK-SM 800A controller was part of the early reporting, not a final conclusion publicly established in the material.

The identity of the attackers, the precise entry point, the complete number of affected companies and the final financial loss remained unclear in the reports.

France’s coordination with European countries is intended to determine whether the disruption extended beyond the French retail sector.

For supermarkets, the incident showed how a remote change to an internet-connected refrigeration system can quickly become a food-safety and business problem.

That conclusion follows from the reported sequence: access to connected controls, abnormal temperature increases, spoiled food, discarded stock and fires at some stores.