Cyberattack forces French supermarket fridges to heat up

A large-scale cyberattack has caused refrigeration units in hundreds of French supermarkets to heat up to 50C, resulting in significant food losses and fires. The Paris prosecutor’s office described the incident as unprecedented, noting that connected refrigerators at several major food retailers across the country were affected. The attack forced temperatures to rise overnight, prompting retailers to discard perishable goods to prevent health risks. The prime minister, Sébastien Lecornu, has instructed France’s national cybersecurity agency, ANSSI, to investigate the breach. Authorities are coordinating with European counterparts, as there are fears that other countries may also be affected, while simultaneously assessing whether additional French firms are at risk.

Les Mousquetaires, the parent company of Intermarché, reported that approximately 150 of its stores were hit. In these locations, fridges were heated to 50C for a period of six hours. A spokesperson for the company confirmed that all food was thrown away to avoid any potential health hazards. Dominique Schelcher, the chief executive of Coopérative U, stated that his supermarkets were also targeted. He described the attack on equipment essential for preserving fresh products and the food supply as of extreme gravity and unprecedented. While Carrefour, Monoprix, and Auchan did not respond to requests for comment, reports indicate that E Leclerc, France’s largest supermarket chain, was also affected. Hackers reportedly managed to remotely trigger forced defrosting in numerous stores, though E Leclerc did not confirm these details.

The incident may have extended beyond France. Ahold Delhaize, a Dutch supermarket company, stated it was dealing with a security issue in its network and had taken several systems offline to protect them. Stores of its Albert Heijn chain in the Netherlands and Belgium remained open, but its online app and delivery system were down, and electronic price tags displayed incorrect information. Belgian media reported that Delhaize supermarkets in Belgium and Luxembourg were also affected. It remains unclear if there is a direct link between the French attack and the issues flagged by Ahold Delhaize. ANSSI identified a vulnerability in software supplied by the Danish company Danfoss. Danfoss acknowledged the incidents, stating that affected units were running outdated firmware. The company noted it had long advised customers to keep supported systems updated and to migrate legacy systems to current-generation solutions. This incident occurs amid growing concern over the potential havoc cyberattacks can cause in Europe, following recent measures ordered by President Emmanuel Macron to protect critical infrastructure from hybrid attacks.