Cyberattack Disrupts French Supermarkets, Spoils Food

Hackers orchestrated a large-scale cyberattack targeting connected refrigerators and freezers in hundreds of French supermarkets overnight, leading to fires, spoiled food, and significant losses. The Paris prosecutor's office confirmed the widespread disruption affecting major food retailers across the country.

French Prime Minister Sebastien Lecornu has directed the National Cybersecurity Agency (ANSSI) to investigate the incident. Authorities are coordinating with European counterparts to assess potential risks in other countries. Early reports suggest that Spain, Portugal, Poland, Germany, and Belgium may also have been affected.

Major retailers reported varying degrees of impact. Carrefour stated that 80 of its supermarkets were affected, while Monoprix indicated that 5% of its approximately 490 stores experienced issues. Les Mousquetaires, the owner of Intermarché, reported that refrigeration units at around 150 of its stores were deliberately heated to 50 degrees Celsius (122 degrees Fahrenheit) for six hours. All affected food was discarded as a precaution.

One Paris resident described witnessing staff discarding large quantities of defrosted frozen goods. The CEO of supermarket group Cooperative U called the attack "of extreme gravity and is unprecedented," emphasizing the targeting of essential food preservation equipment. The CEO of Intermarché estimated the nationwide losses could amount to tens of millions of euros in a single day.

The attacks appear to have exploited vulnerabilities in software supplied by the Danish company Danfoss, which manufactures refrigeration control systems. A source close to the French government indicated that ANSSI identified a vulnerability in Danfoss software. Danfoss acknowledged awareness of incidents affecting a limited number of their refrigeration management systems, noting that the affected units were running outdated firmware. The company stated it has long advised customers to update firmware and migrate legacy systems.

Cybersecurity firm Claroty's research from August detailed vulnerabilities in the Danfoss AK-SM 800A controller, which Danfoss had issued software updates to address. The incidents bear resemblance to disruptions reported at U.S. military commissaries in late August, which also led to food losses due to affected refrigeration.

The French retail association Fédération du Commerce et de la Distribution called for full transparency from Danfoss and stated that efforts are underway to restore operations, with some impacted stores already back online. The incident has highlighted the importance of supply chain resilience, according to Eurocommerce director general Christel Delberghe.

Separately, Dutch retailer Ahold Delhaize reported a "security issue" affecting its network, leading it to take several systems offline as a precaution. This incident impacted online grocery delivery services and websites for its U.S. chains, including Stop & Shop, Giant, Hannaford, and Food Lion, though Ahold Delhaize stated there was no known link between its issue and the French supermarkets.