Hundreds of supermarkets across France have been hit by a large-scale cyberattack that disrupted refrigeration systems, spoiled fresh and frozen food, and triggered fires at several stores. The attack, reported over the weekend of October 11-12, targeted big retailers such as Intermarché, Coopérative U, Carrefour, E.Leclerc and Monoprix. That’s why France’s authorities have initiated an investigation into the security of connected refrigeration devices.
Hackers were able to remotely disrupt the refrigeration controls, which led to temperatures reaching as high as 50 degrees Celsius, according to reports by Reuters and Agence France-Presse (AFP) on October 12. The incident marked an exposure of vulnerabilities in internet-connected systems for preserving food in large retail outlets. French Prime Minister Sébastien Lecornu ordered the country’s National Cybersecurity Agency (ANSSI) to investigate; authorities started coordinating with European authorities regarding possible threats over the border.
More than 300 stores from the supermarkets Intermarché and Netto were attacked, and over 100 stores belonging to the Coopérative U supermarket chain, according to figures reported by AFP. The French supermarket chain Carrefour confirmed 80 supermarkets were impacted, and Monoprix said that around 5% of its roughly 490 stores in France were affected. E. Leclerc also reported on incidents at multiple outlets.
Affected retailers had to dispose of fresh and frozen products to avoid potential food issues due to the disruption. Intermarché CEO Thierry Cotillard told French broadcaster BFM TV that losses could reach tens of millions of euros nationwide in a single day.
Attacking equipment which is so vital to food preservation and national food production is completely unacceptable, Coopérative U CEO Dominique Schelcher posted on X.
The refrigeration management systems provided by Danish company Danfoss are being investigated. These are all connected systems to control temperatures throughout the supermarket fridge/freezer systems and let technicians monitor and manage the equipment remotely.
Danfoss stated that it knew of incidents which occurred in France with a limited number of refrigeration management systems. The company stated the impacted units were operating on outdated firmware and urged customers to upgrade supported systems and replace older equipment.
The attack follows research published by Claroty on August 9, which detailed vulnerabilities in Danfoss systems that could allow attackers to bypass authentication controls.
Spain, Portugal, Poland, Germany and Belgium also suffered, said Felix Aime, a senior cyberthreat intelligence analyst at the Sekoia Threat Detection and Research.
France’s retail federation wants Danfoss to be “transparent” during the investigation. Police are also probing if other French companies are vulnerable.
Steven Lachance, a analyst, told Al Jazeera that the scope of the incident was unusual and that flaws in interconnected industrial gear could put other critical services at risk, such as energy networks and hospitals.
The incident has sparked renewed concerns over the security of systems connected to the internet that control physical infrastructure. Retailers are now trying to get the refrigeration systems back up and running to minimise food loss and keep potentially unsafe food out of people’s hands.
