Cyberattack disrupts refrigeration at French supermarkets

French authorities said on October 12 that a cyberattack had affected connected refrigerators at several major food retailers across France, disrupting refrigeration systems and prompting food disposal at affected supermarkets. Prime Minister Sébastien Lecornu instructed the national cybersecurity agency, ANSSI, to investigate.¹

Retailers report disruption

The Paris prosecutor’s office said the incident was “affecting connected refrigerators in several major food retailers across France”. Les Mousquetaires, the owner of Intermarché, reported that about 150 Intermarché stores had been hit. It said refrigerators reached 50C for six hours, and food was discarded to avoid health risks. Separate reporting described large quantities of frozen food being disposed of at an affected Intermarché outlet.¹³

Coopérative U was also affected, according to its chief executive, Dominique Schelcher. Reporting by several outlets put the number of affected Coopérative U stores at fewer than 100. Carrefour said that 80 of its 6,000 sites were affected, although reporting on the precise Carrefour total was not consistent. Some E Leclerc stores were also reported to have been targeted.¹²³⁴

Refrigeration software under scrutiny

The attack reportedly involved remote access to cooling controls and forced defrosting. ANSSI identified a vulnerability in software supplied by Danish refrigeration company Danfoss, according to the Guardian. Danfoss said systems involved in the incidents were running outdated firmware and said it was working with customers on mitigation measures.¹²

Danfoss said most of the compromised units were older products that had reached end of life and no longer received software or security updates. Cybersecurity researchers had disclosed vulnerabilities in more than 2,000 Danfoss controllers in August, including a hidden authentication mechanism that Team82 said could be used to interfere with refrigeration operations. TF1 reported that one vulnerability could allow authentication to be bypassed without an identifier or password.²⁴

The identity of the attacker had not been established and no group had claimed responsibility by the time of the October 12 reports. It was also not established whether a security issue reported by Ahold Delhaize, which took several systems offline, was connected to the French attack. Albert Heijn stores in the Netherlands and Belgium remained open, while its app and delivery service were reported down.¹²⁴

Official response

France was coordinating with European counterparts because other countries could potentially be affected, according to the Guardian. The reported disruption illustrates how connected systems used in food retail can create operational consequences when their security is compromised. Danfoss has advised customers to keep supported systems updated and to move legacy equipment to current-generation products.¹²