Hackers remotely set fire to refrigerators in french supermarkets

A large-scale cyberattack affected hundreds of supermarkets in France after hackers managed to remotely alter the temperatures of commercial refrigerators and freezers, raising them to as high as 50 degrees Celsius. The incident, which occurred overnight, caused fires and the destruction of significant quantities of food products, generating losses estimated at tens of millions of euros, according to an announcement by the Paris prosecutor's office.

The Paris prosecutor's office confirmed on Monday that it had launched an investigation into the cyberattack, which targeted internet-connected refrigeration systems belonging to several major food retail chains in France. Authorities stated that the incident had significant consequences, ranging from the loss of food stocks to the outbreak of fires.

French Prime Minister Sebastien Lecornu requested that the National Cybersecurity Agency (ANSSI) investigate the attack, according to a source within his office. Meanwhile, French authorities are cooperating with their counterparts in other European countries, amid indications that the attack may have spread beyond France's borders. Risks to other French companies are also being assessed.

Felix Aime, a cyber threat analyst at Sekoia Threat Detection and Research, stated that similar incidents had also been recorded in Spain, Portugal, Poland, Germany and Belgium.

Among the French retailers affected are Carrefour, which reported problems in 80 supermarkets, and Monoprix, where approximately 5% of its roughly 490 stores were targeted by the attack.

The Les Mousquetaires group, owner of the Intermarche chain, announced that refrigeration systems in approximately 150 stores had been heated to 50 degrees Celsius, a temperature maintained for six hours overnight. Company representatives stated that all affected food products had been discarded to prevent potential risks to consumer health.

At an Intermarche supermarket in central Paris, employees were forced to throw away large quantities of thawed frozen products. Witnesses described scenes in which entire shopping carts filled with food were emptied into large containers, while melted ice cream leaked from damaged packaging directly onto the street.

The Cooperative U group also confirmed that it was among the targets of the attack. Chief Executive Dominique Schelcher described the incident as unprecedented, emphasizing the seriousness of the compromise of equipment essential for food preservation and supplying the French population.

So far, there is no comprehensive assessment of the damage recorded across the entire industry. Nevertheless, Thierry Cotillard, CEO of Intermarche, told BFM TV that the attack, which he described as unprecedented, could cause losses amounting to tens of millions of euros nationwide in a single day.

Christel Delberghe, Director General of the European retail association EuroCommerce, warned that the incident demonstrates the need to strengthen the resilience of the entire supply chain.

• Vulnerabilities in internet-connected refrigeration systems at the center of the investigation

The attack exploited the digital infrastructure used to manage refrigeration systems in supermarkets. Normally, commercial refrigerators and freezers are coordinated through centralized control panels, which allow temperatures to be monitored and adjusted remotely, including via the internet.

This architecture facilitates rapid intervention by maintenance companies but can become a major vulnerability when equipment does not receive security updates or is improperly configured.

According to a source close to the French Prime Minister, ANSSI identified a vulnerability in software supplied by the Danish company Danfoss, a manufacturer of refrigeration control solutions.

Danfoss confirmed that it was aware of the incidents in France, which affected a limited number of refrigeration equipment management systems. The company stated that the compromised units were running outdated versions of firmware, the embedded software that controls equipment operation.

The Danish manufacturer emphasized that it has long recommended that customers install the latest available updates and replace older systems with next-generation technological solutions.

The security risks associated with this equipment had previously been reported. On August 9, the Team82 research team at cybersecurity company Claroty published an analysis of vulnerabilities in the Danfoss AK-SM 800A controller.

According to the researchers, the identified issues could have allowed attackers to bypass authentication mechanisms and execute computer code on compromised devices. Danfoss had released software updates intended to address these vulnerabilities.

The incident in France bears similarities to disruptions recorded in late August at approximately 12 grocery stores serving US military personnel, where the compromise of refrigeration systems caused the destruction of product stocks.

The French Federation of Commerce and Distribution (FCD) called on Danfoss to provide full transparency regarding the circumstances of the attack. The organization stated that retailers' priority is to protect consumers and restore operations as quickly as possible. Some of the affected stores have already resumed operations.

• Cybersecurity problems also in the Netherlands. Ahold Delhaize suspended several systems

Separately, Dutch-Belgian group Ahold Delhaize, one of the largest international food retail operators, announced that it was dealing with a security incident within its own computer network and had decided to deactivate several systems as a precautionary measure.

The company operates Albert Heijn, the largest supermarket chain in the Netherlands, and has a significant presence in the US market.

Albert Heijn customers were informed through the mobile application that grocery delivery services were unavailable due to a cybersecurity incident.

Online sales account for approximately 10% of Albert Heijn's turnover. Physical stores remained open, but the suspension of deliveries led to an increase in orders placed with competing retailers, according to the Dutch news agency ANP.

Ahold Delhaize stated that, at present, there is no reason to believe that the incident within its network is connected to the attacks on French supermarkets.

The group is the fourth-largest food retailer in the United States, where it operates the Stop & Shop, Giant, Hannaford and Food Lion chains. Their websites displayed messages regarding the temporary unavailability of online services.

The attacks highlight the vulnerabilities of commercial infrastructures that are increasingly dependent on internet-connected systems, particularly in sectors such as food distribution, where the compromise of digital equipment can cause not only operational disruptions but also significant material losses and risks to consumer safety.