Hackers remotely heat fridges at hundreds of French supermarkets

A cyberattack that remotely heated refrigerators and freezers at hundreds of French supermarkets has caused widespread food losses and renewed concern over the security of connected equipment used in essential supply chains.

Attackers manipulated refrigeration systems overnight on Sunday, 11 October, raising temperatures at some stores to as high as 50 degrees Celsius, or 122 Fahrenheit. Refrigerated and frozen goods had to be discarded, while fires were reported at several locations.

The Paris prosecutor’s office described the incident as a large-scale attack affecting connected refrigeration equipment at several major food retailers. French Prime Minister Sébastien Lecornu asked the country’s national cybersecurity agency, ANSSI, to investigate.

Carrefour said 80 of its supermarkets were affected. About 5% of Monoprix’s roughly 490 French stores were hit, while Les Mousquetaires, the owner of Intermarché, said refrigeration systems at about 150 stores were heated to 50 degrees Celsius for around six hours.

Intermarché discarded all affected food as a precaution.

Thierry Cotillard, president of Les Mousquetaires, told BFM TV that losses across the country could run into tens of millions of euros in a single day.

Coopérative U said 80 of its roughly 2,000 stores were affected. Chief Executive Dominique Schelcher said on Tuesday that most avoided a break in the cold chain after store teams and refrigeration technicians intervened, although some outlets had to discard stock.

“Targeting equipment essential to the preservation of fresh products and to the food supply of the French people is of extreme gravity and is unprecedented,” Schelcher said, adding that losses could range from tens of thousands of euros at smaller stores to about €200,000 at a hypermarket.

The attack appears to have exploited refrigeration management systems that can be accessed remotely by maintenance contractors.

Modern supermarkets increasingly connect refrigeration controllers to the internet so technicians can monitor temperatures, diagnose faults and alter settings without visiting a store. That convenience also creates a route into equipment whose failure can quickly destroy large amounts of food.

French authorities identified a vulnerability in software supplied by Danish industrial equipment maker Danfoss, according to Reuters.

Danfoss said the affected systems were running outdated firmware and that customers had long been advised to install current versions and replace legacy equipment where necessary.

Cybersecurity company Claroty had published research in August on vulnerabilities in Danfoss’s AK-SM 800A refrigeration controller. The flaws included weaknesses that could allow an attacker to bypass authentication and execute code on a compromised unit. Danfoss issued software updates addressing the problems.

Connected industrial equipment now controls physical processes ranging from refrigeration and heating to manufacturing lines, power systems and building infrastructure. An attack on such systems can create an immediate physical and financial loss without stealing a single customer record.

The French attack was particularly unusual because the apparent objective was disruption rather than conventional ransomware.

There was no publicly reported ransom demand. Instead, the attackers manipulated a routine refrigeration function and turned it against retailers.

Refrigeration equipment periodically runs a defrost cycle to prevent ice buildup. By keeping systems in that state or altering their operating temperatures, an attacker can make equipment designed to preserve food heat it instead.

The consequences extend beyond replacing spoiled products. Stores may have to close aisles, inspect refrigeration equipment, restore systems and prove that food remains safe before returning it to shelves.

The attack also exposes the risks created by older operational technology.

Industrial and building systems can remain in service for years or decades. Unlike laptops or phones, they are often difficult to replace and may run software that receives infrequent security updates. Retailers can therefore end up operating a mixture of modern networks and aging controllers connected to them.

France is examining whether the attack extends beyond its borders.

A senior cyber threat intelligence analyst at French cybersecurity company Sekoia told Reuters that Spain, Portugal, Poland, Germany and Belgium had also been affected.

French officials said they were coordinating with European counterparts and assessing whether other companies could be vulnerable.

Separately, Dutch supermarket group Ahold Delhaize took systems offline after detecting what it called a cybersecurity issue. Online grocery deliveries at Albert Heijn were disrupted, while websites belonging to several of Ahold’s US chains were temporarily unavailable.

Ahold said there was no reason at that stage to connect its incident with the French refrigeration attacks.

The French retail federation has called for full disclosure from Danfoss as investigators try to establish who carried out the attack and how widely vulnerable refrigeration controllers remain in use.