Cyberattack on Refrigeration Systems Hits Hundreds of French Supermarkets, Retailers and Prosecutors Say

A cyberattack on refrigeration systems at hundreds of supermarkets in France raised the temperature of fridges and freezers to as high as 50 degrees Celsius, spoiling food and causing fires at several stores, Al Jazeera reports.

Retailers including Intermarché, Coopérative U and E Leclerc confirmed the attack on Monday 12 October, calling it “unprecedented”. The Paris prosecutor’s office has opened an investigation into what it called a large-scale cyberattack on connected refrigerators at several major food retailers. The reports reviewed do not say who carried it out.

How Many Stores

Figures differ between reports. Al Jazeera, citing the AFP news agency, says at least 300 Intermarché or Netto shops and more than 100 Coopérative U outlets were targeted, while Carrefour said 80 supermarkets were affected and Monoprix said about 5% of its roughly 490 stores were hit. Euronews, in an earlier report, gave 150 to 200 Intermarché stores and nearly 100 Coopérative U outlets.

Intermarché told AFP that affected stores would have to throw away all their fresh and frozen products. Its chief executive, Thierry Cotillard, told BFM TV the attack represented losses of tens of millions of euros nationwide in a single day, according to Al Jazeera. Dominique Schelcher, chief executive of Coopérative U, said the disruption to refrigeration began on Sunday night.

A Software Vulnerability

Prime Minister Sébastien Lecornu ordered France’s National Cybersecurity Agency (ANSSI) to investigate, a person in his office told Reuters. The source said ANSSI had identified a vulnerability in software supplied by Danish company Danfoss, and that France was coordinating with European counterparts because other countries could be affected.

Danfoss said it was aware of incidents in France affecting a limited number of refrigeration management systems, and that the affected units were running outdated firmware. The company said it had long advised customers to keep systems updated and replace older equipment. Al Jazeera notes that the cybersecurity firm Claroty published research on 9 August describing vulnerabilities in Danfoss systems that could allow attackers to bypass authentication. France’s retail federation, the FCD, called on Danfoss to provide full transparency and said some affected stores were already operating again.

Beyond France

Felix Aime, a senior analyst at the firm Sekoia, told Reuters that Spain, Portugal, Poland, Germany and Belgium had also been affected. Cybersecurity analyst Steven Lachance told Al Jazeera that the attack was not unprecedented, though rare in its scale, and said that once a vulnerability is found in internet-connected equipment, attackers can log in remotely and trigger its functions.

Why It Matters

The attack targeted the equipment that keeps fresh and frozen food cold, and Al Jazeera notes that such control panels are typically accessible over the internet so that maintenance firms can adjust them from anywhere. The reports reviewed do not yet say who is responsible, what the total losses are or which other countries were affected; the investigation by the Paris prosecutor and France’s cybersecurity agency is under way.