Massive Cyberattack Cripples French Supermarkets, Causing Widespread Food Spoilage and Fires

Hundreds of French supermarkets experienced a significant disruption this week due to a cyberattack targeting their refrigeration systems. The attack caused temperatures in fridges and freezers to soar as high as 50 degrees Celsius (122F), leading to extensive food spoilage and even igniting fires in several locations. Major retailers including Intermarche, Cooperative U, E Leclerc, Carrefour, and Monoprix confirmed the widespread and "unprecedented" cyberattack, which occurred on Monday.

At least 300 Intermarche or Netto stores were affected, alongside over 100 Cooperative U outlets. Carrefour reported 80 of its supermarkets were impacted, while Monoprix stated approximately 5 percent of its nearly 490 stores were hit. E Leclerc also confirmed that several of its stores were targeted.

The Paris prosecutor’s office described the "large-scale" attack as having affected "connected refrigerators in several major food retailers across France," resulting in significant food losses and fires. In response, Prime Minister Sebastien Lecornu has directed France’s National Cybersecurity Agency (ANSSI) to launch an investigation. A source close to the Prime Minister indicated that France is collaborating with European partners due to the potential for the attack to affect other countries and that authorities are assessing risks to other French companies.

While an industry-wide loss estimate is not yet available, Intermarche CEO Thierry Cotillard estimated the losses could amount to "tens of millions of euros nationwide in a single day." According to BFM TV, hackers remotely initiated a "forced defrosting" of refrigeration systems, leading to the "destruction of stocks of fresh and frozen products." Intermarche announced that affected stores would need to discard all fresh and frozen products. Dominique Schelcher, CEO of Cooperative U, stated that the disruption to essential preservation equipment since Sunday night was "extremely serious and unprecedented," calling it "unacceptable." His teams are working to restore operations, and an investigation is planned.

Supermarket cold aisles are typically managed by internet-accessible control panels, allowing remote adjustments by maintenance companies. ANSSI has identified a vulnerability in software supplied by Danish company Danfoss as a potential cause. Danfoss acknowledged the incidents, noting that the affected units were running outdated firmware and reiterated its prior advice to customers to update systems and replace older equipment. Cybersecurity firm Claroty had previously published research detailing vulnerabilities in Danfoss systems that could permit attackers to bypass authentication.

France's retail federation, the FCD, has requested full transparency from Danfoss. Some affected stores have already resumed operations. Felix Aime, a cyberthreat intelligence analyst at Sekoia Threat Detection and Research, reported that Spain, Portugal, Poland, Germany, and Belgium may have also experienced similar disruptions. The attack bears resemblance to incidents in late August at US military commissaries, which also resulted in food losses due to refrigeration system issues.