Refrigerators in hundreds of French supermarkets were victims of a cyberattack

Several supermarkets were victims of an "unprecedented" cyberattack targeting their refrigeration facilities overnight from Sunday to Monday, including 150 to 200 Intermarché stores and less than a hundred Coopérative U outlets. Tons of fresh produce could be thrown away to avoid any health risk, while an investigation has been opened in Paris.

Several French supermarket chains were victims, between Sunday night and Monday, of an "unprecedented" cyberattack targeting their refrigeration facilities, raising concerns about food safety.

At least 300 Intermarché/Netto outlets, fewer than 100 in the Coopérative U network, "several stores" in the E.Leclerc group, 80 Carrefour supermarkets and around 30 Monoprix stores were affected by this attack, these distributors confirmed to AFP.

When contacted by AFP, the Paris prosecutor's office announced the launch of its own investigation into "the large-scale cyberattack affecting the connected refrigerators of several major food retailers across France".

The investigation, led by the anti-cybercrime section and "entrusted to the Office against cybercrime (OFAC), should make it possible to identify the victims and establish the link with the damage reported by them in terms of food losses," he specified.

The matter is being taken seriously by both French and Brussels authorities. According to sources close to the Prime Minister, Sébastien Lecornu "immediately asked the National Cybersecurity Agency of France (ANSSI) to take up the issue" and "is personally monitoring the case."

The agency has identified "a vulnerability in software provided by a Danish company and has contacted the publisher," the same source stated. "It is in contact with its European counterparts, as other countries may be affected," and is seeking "to identify other affected French companies in order to alert them" and "prevent the spread."

"Food waste"

According to a source close to the case, the refrigeration control systems of the Danish manufacturer Danfoss were targeted.

The Scandinavian company explained to AFP that "the majority of affected units are older products (...) which have reached the end of their life and no longer receive software or security updates."

Danfoss emphasizes that it has "long recommended to its customers to keep supported systems up to date and to migrate legacy systems to current generation solutions."

According to BFMTV, the hackers were thus "successfully able to remotely trigger the forced defrosting" of refrigerators, freezers and other cold rooms in many stores.

Intermarché emphasized that these stores are forced to "discard all" affected products to maintain the cold chain, lamenting the "food waste" and financial "loss," without specifying the amount. The retailer believes that "one of the major challenges" will be insurance, which "does not cover this type" of in-store incident.

"Attacking equipment essential to the preservation of fresh produce and the food supply of the French is extremely serious and unprecedented," reacted the CEO of Coopérative U, Dominique Schelcher, on X.

"Our teams are fully mobilized, in conjunction with the refrigeration specialists, to restore the situation as quickly as possible," while "an investigation will be carried out to shed full light" on the incident, he added.

E.Leclerc also confirmed to AFP that "a cyberattack has affected one of its refrigeration equipment suppliers", resulting in "repercussions on the operation of refrigeration equipment in several stores".

According to the specialist website "Je bosse en grande distribution", Carrefour Market stores are also affected.

An attack that demonstrates a "certain level of sophistication"

Danfoss had announced several serious vulnerabilities in recent months in some of its software used in refrigeration systems. On September 18, the Danish manufacturer reported a flaw that allowed "attackers to gain read and write access to internal values, download and execute" unsecured computer programs.

"The State is mobilized, it is anticipating and coordinating, in France as well as with our European partners," according to sources close to the Prime Minister.

For its part, the Ministry of Commerce indicated that it was "in contact with distributors".

European Commissioner for Agriculture, Christophe Hansen, for his part, "firmly" condemned the cyberattack on X, calling for "more attention at all levels" for "food security", as "the instrumentalization of food has become a reality".

Long isolated from the internet, industrial equipment such as refrigeration units are now connected via sensors or remote monitoring systems, explains Antoine Hautin, Secretary General of Almond, a cybersecurity consulting firm, to AFP.

"Historically, these systems were designed to prioritize reliability and cost control, rather than protection against cyberattacks" because "attackers could not access them remotely," the expert points out.

By likely affecting hundreds of devices simultaneously, Monday's attack demonstrates "a certain level of sophistication," he believes.