Cyberattack Disrupts French and Dutch Supermarkets, Exposing Supply Chain Vulnerabilities

France's cybersecurity authority has warned that a cyberattack targeting supermarkets may still be underway as stores restocked Wednesday after the incident sent refrigerator temperatures soaring, raising concerns about the security of vital food supply chains.

The agency stated Tuesday night that the attacks were "likely still underway." It advised stores to reconnect refrigerators to the internet only through secure VPN connections or protected networks, install firmware updates, and change passwords.

Attackers remotely seized control of refrigeration systems in hundreds of supermarkets and independent stores across France in the early hours of Monday. Temperatures reportedly reached 50 degrees Celsius (122 degrees Fahrenheit) for approximately six hours, forcing stores to discard fresh and frozen goods. The Intermarché supermarket chain reported losses amounting to "tens of millions of euros" in a single day.

In the Netherlands, a major supermarket chain was restarting systems it had shut down as a precaution amid what parent company Ahold Delhaize described as a "cybersecurity incident." This incident halted home deliveries and disrupted some supplies to its extensive network of stores across the country.

Authorities in both nations are investigating the cyber incidents, which have exposed vulnerabilities in some older refrigeration management systems and in the countries' highly efficient food supply chains.

The Dutch National Cybersecurity Centre indicated that several cyber incidents had affected Europe's food sector, but it saw "no reason at this time to believe that these incidents are linked."

Europol, the European Union's police agency, confirmed it was in contact with authorities in the affected countries but declined to provide details, citing an ongoing investigation. No perpetrators have been publicly identified, and no claims of responsibility have been made public.

François Deruty, former operations director at the French Cybersecurity Agency and now chief intelligence officer at cybersecurity company Sekoia, suggested that the perpetrators could range from sophisticated state-sponsored actors to a disgruntled individual. He noted the timing of the attack amidst ongoing protests in France, adding that it "resonates with all citizens in their everyday lives."

Stores are still working to assess the full impact. Antony Bohne, director of Intermarché La Villette in Paris, reported that while an early alert saved most of his fresh fruit and vegetables, it was too late for his frozen goods, which had already begun to thaw.

The incident has highlighted the reliance of supermarkets on rapid delivery systems. Pieter Zwaan, a senior researcher at the Clingendael Institute, noted that without IT and electricity, the frequent deliveries required to keep Dutch supermarket shelves stocked would be impossible.

French Finance Minister Roland Lescure stated that approximately 700 of the country's 10,000 supermarkets were affected. While assuring that there was no risk to France's overall food supplies, he acknowledged that the attack "touches the heart of our food security" and served as a "wake-up call for everyone."

Deruty pointed out that the software vulnerabilities exploited in the French hack were "an accident waiting to happen," attributing the issue to a failure to apply security updates. He emphasized that despite growing awareness of cyber risks, some businesses, particularly smaller franchises, may still underestimate their vulnerability.

The French cybersecurity agency identified compromises involving refrigeration system remote control modules from Danish company Danfoss and U.S.-based Copeland. Danfoss confirmed that many affected systems were older models no longer receiving updates and is assisting customers. U.S. cybersecurity firm Claroty had identified vulnerabilities in these systems in an August report, noting that some controllers were directly accessible from the internet. Both Danfoss and Copeland have since addressed the vulnerabilities.