Hackers raised the temperature of refrigerators and freezers in hundreds of French supermarkets to 50 degrees Celsius (122 degrees Fahrenheit), causing fires and spoiling food.
The Paris public prosecutor’s office said on Monday that the “large-scale” attack “affected connected refrigerators in several major food retailers across France,” leading to food loss and fires.
Prime Minister Sébastien Lecorne has instructed France’s National Cyber Security Agency (ANSSI) to investigate, a source from the prime minister’s office said.
The official said France was coordinating with European countries as other countries could also be affected, adding that authorities were assessing whether other French companies were also at risk.
Felix Emme, senior cyber threat intelligence analyst at Sekoia Threat Detection and Research, said Spain, Portugal, Poland, Germany and Belgium were also affected.
Carrefour said 80 of its supermarkets were affected, and Monoprix, which operates about 490 stores in France, said 5% of its stores were affected.
Les Mousquetaire, owner of retailer Intermarche, said refrigerators in about 150 stores were heated to 50 degrees Celsius for six hours overnight. A spokesperson said all affected food had been discarded to eliminate any health risks.
Paris resident Geert de Clercq witnessed staff at Intermarché in central Paris dump cartloads of defrosted frozen food into a giant trash can, while melted ice cream flew out of broken pails on the street.
Cooperative U CEO Dominique Schelcher said her supermarket group was also targeted.
“Targeting equipment essential to preserving fresh food and feeding the French population is extremely serious and unprecedented,” he wrote to X.
Food retailers E. Leclerc and Ocean did not respond to requests for comment.
There was no immediate estimate of industry-wide losses, but Intermarche CEO Thierry Cotillard told BFM TV that the “unprecedented” attack would result in losses of “tens of millions of euros nationwide in one day.”
“This incident highlights the importance of resilience throughout the supply chain,” said Christelle Delberghe, director general of the European retail association Eurocommerce.
Supermarket refrigerated aisles are typically operated by control panels that manage refrigerators and freezers throughout the store and are accessible via the Internet, allowing maintenance companies to adjust them from anywhere.
A source close to Lecornu said ANSSI had identified a vulnerability in software provided by Danish company Danfoss.
Danfoss said it was “aware of an incident in France affecting a limited number of refrigeration management systems.”
Danfoss said the affected units were “running outdated firmware,” adding: “We have long advised customers to always update supported systems with the latest firmware and migrate legacy systems to current generation solutions.”
On August 9, cybersecurity firm Claroty’s Team82 published research detailing vulnerabilities in Danfoss AK-SM 800A controllers. According to the report, a software update issued by Danfoss addressed an issue that could allow attackers to bypass authentication controls and execute code on a compromised device.
The attack is similar to disruptions reported at about a dozen U.S. military commissaries in late August, when refrigerators were affected and food was wasted.
In a statement, the French Federation of Retail Associations called for “full transparency” from Danfoss over the incident. The supermarket said it aims to protect consumers and return to normal operations as soon as possible. According to FCD, some of the affected stores have already been restored and are open for business.
Dutch retailer Ahold Delhaize, which operates the Netherlands’ largest supermarket chain Albert Heijn and has large operations in the United States, said it was dealing with a “security issue” on its network and had taken some systems offline as a precaution.
The retailer’s smartphone app displayed a message saying groceries could not be delivered due to a “cybersecurity incident.”
Online orders account for about 10% of Albert Heijn’s sales. While brick-and-mortar stores remain open, Dutch news agency ANP reported a surge in delivery orders from competing retailers.
Ahold Delhaize said there was no reason to think there was a link between the French incident and the country’s supermarkets.
Ahold is the fourth largest grocery retailer in the United States. The websites of the Stop & Shop, Giant, Hannaford and Food Lion chains displayed notices saying their sites were temporarily down.
