French authorities have launched an investigation into a large-scale cyberattack that forced refrigeration systems in hundreds of supermarkets to overheat, leading to fires, spoiled food, and financial losses. The Paris prosecutor’s office confirmed the probe on Monday, describing the incident as an attack on connected refrigerators across multiple major food retailers.
Key developments
- Prosecutors open investigation: The Paris prosecutor’s office announced a formal inquiry into the cyberattack, which affected refrigeration systems in several major supermarket chains. Authorities are coordinating with European counterparts to assess potential cross-border impacts.
- Confirmed damage and losses: Affected retailers reported fires, spoiled food, and significant financial losses. Intermarché, one of the hardest-hit chains, discarded food from 150 stores after fridges reached 50°C (122°F) for six hours. Carrefour reported 80 affected stores out of its 6,000 nationwide, while Coopérative U confirmed over 100 outlets were targeted.
Impact on retailers and supply chains
The attack disrupted operations at multiple chains, including Intermarché, Carrefour, E.Leclerc, Monoprix, and Auchan. Intermarché described the incident as unprecedented, with fridges overheating overnight and forcing the disposal of perishable goods to mitigate health risks. Coopérative U’s CEO Dominique Schelcher called the attack “of extreme gravity,” emphasizing the threat to food security. Two supermarkets in France’s Alsace region reported losses of €270,000 (£228,000) between them, with nationwide damages estimated in the millions.
Technical details and potential origins
Investigators are examining whether the attack targeted refrigeration control systems manufactured by Danfoss, a Danish company. A source close to the issue indicated that most affected equipment was legacy systems no longer receiving security updates. Danfoss confirmed in a statement that its AK-SM 800 series, among other products, was implicated, though the company did not confirm whether its own systems were breached. Reports suggested hackers may have exploited vulnerabilities in connected refrigeration units to remotely trigger forced defrosting cycles, causing overheating.
Official responses and condemnation
French Prime Minister Sébastien Lecornu directed the National Cybersecurity Agency (ANSSI) to investigate, with officials noting potential coordination with European partners. EU Food and Agriculture Commissioner Christophe Hansen condemned the attack, stating on X (formerly Twitter) that “the weaponisation of food has become a reality” and calling for heightened attention to food security. French broadcaster BFMTV reported that some staff encountered waves of hot air when opening freezer units, with images showing a freezer in an ice cream aisle displaying a temperature of 26.5°C (79.7°F).
Broader implications for food security and cybersecurity
The incident has raised concerns about the vulnerability of critical infrastructure to cyber threats. Retailers and cybersecurity experts warn that attacks on essential systems, such as refrigeration, could have cascading effects on food supply chains. The use of legacy equipment in the attack highlights ongoing challenges in securing industrial control systems against modern cyber threats. Authorities have not yet attributed the attack to a specific group or motive, and the full scope of the breach remains under investigation.
Retailers’ statements and recovery efforts
- Intermarché: Confirmed 300+ stores (including Netto-branded locations) were affected, with fridges overheating for six hours. The chain discarded all spoiled food to avoid sanitary risks.
- Carrefour: Reported 80 affected stores but stated the vast majority of its locations remained operational.
- Coopérative U: Over 100 stores were targeted, with CEO Schelcher calling the attack “extremely serious and unprecedented.”
- E.Leclerc: Acknowledged a cyberattack on a refrigeration equipment supplier, which impacted refrigeration systems in several stores.
Authorities have urged caution while investigations continue, emphasizing the need to secure critical infrastructure against future attacks.