Cyberattack Overheats Supermarket Refrigerators in France
Hackers have remotely overheated refrigerators at more than 500 supermarkets across France, leading to the destruction of tons of fresh and frozen food. This unprecedented cyberattack has left retailers facing millions of euros in losses, with some stores temporarily closing due to the incident.
The attack occurred overnight into Monday, affecting various supermarket chains including Intermarche, Netto, Cooperative U, Carrefour, Monoprix, and E.Leclerc. Reports indicate that around 300 Intermarche and Netto stores, 100 Cooperative U outlets, 80 Carrefour supermarkets, and 30 Monoprix locations were impacted.
In addition to supermarkets, the cyberattack also affected wholesaler Metro and members of the French meat industry association, Culture Viande, along with independent butchers. The hackers targeted refrigeration controllers supplied by Danish manufacturer Danfoss, which allow technicians to adjust temperatures remotely. They activated automatic defrosting systems, causing refrigeration units to heat up to temperatures as high as 50 degrees Celsius, rather than maintaining the necessary cold temperatures.
Employees arriving at work discovered overheated refrigeration units and shelves filled with unsellable food. In some instances, hackers extended the defrost cycle from one hour to eight hours, delaying alarms and maximizing damage. The financial impact is significant, with an Intermarche in Haguenau reporting losses of around €50,000 (approximately $56,000) in frozen food, while an E.Leclerc store in Wasselonne had to discard products valued at €220,000.
Industry Leaders React to Unprecedented Attack
Dominique Schelcher, CEO of Cooperative U, described the attack as unprecedented and unacceptable. Thierry Cotillard, head of Intermarche, estimated that the total losses across the nation could reach tens of millions of euros. As of now, the attackers have not been identified, and no ransom demands have been reported. The method of intrusion remains unclear, although an Intermarche spokesperson indicated that the attack affected a service provider managing refrigeration equipment.
Final Assessment
Cybersecurity researcher Kevin Beaumont noted that thousands of Danfoss controllers are accessible over the internet, often with default usernames and passwords that change daily. Danfoss acknowledged that the most affected systems were outdated models that no longer receive security updates. France's cybersecurity agency, ANSSI, has advised operators to disconnect vulnerable management interfaces from the internet or limit access to trusted connections.
Danfoss equipment has previously been linked to major cyberattacks, including incidents involving Russian and Israeli supermarkets in 2022. The company cited inadequate firewall or VPN protection as contributing factors to these breaches.
