Major French supermarket chains on Monday said they were hit by a cyberattack that caused their refrigerators to shoot up in temperature in hundreds of stores, forcing spoiled food to be thrown away and raising concerns about food security. Top retailers E. Leclerc, Intermarche and Cooperative U confirmed to AFP they suffered a cyberattack that Cooperative U’s chief executive described as “unprecedented.” “Food security requires more attention at all levels,” said the EU’s food and agriculture commissioner Christophe Hansen on X, condemning the attack and saying such “exploitation of food” was now a “reality.” At least 300 shops of Intermarche or its Netto brand were targeted, along with over 100 Cooperative U outlets, and several E. Leclerc stores, the retailers told AFP in separate statements. Paris prosecutors confirmed the attack, which reportedly also hit other major chains, and also indicated it had sparked fires. BFM TV said hackers “managed to remotely trigger the forced defrosting of the refrigeration systems in numerous stores.” Those branches that were affected will have to “throw away all of the products” that are fresh and frozen, Intermarche told AFP. Specialist French retail sector news website jebosseengrandedistribution.fr said other retail giants Carrefour Market and Monoprix were affected but the companies have yet to confirm this. E. Leclerc confirmed to AFP “that a cyberattack affected one of its refrigeration equipment suppliers,” resulting in “repercussions on the operation of refrigeration systems in several stores.” A source close to the issue said refrigeration control systems from Danish manufacturer Danfoss were targeted. Danfoss told AFP in a statement that most of the affected equipment was “legacy” products which “no longer receive software or security updates.” It said its AK-SM800 and AK-SC355 fridge regulator systems were notably affected, with a version of the former using “outdated firmware.” It added that it had long advised supermarkets to update from those models. Danfoss gave no figures of how many systems were affected. Effort to contain the hack A person close to French Prime Minister Sebastien Lecornu said France’s cyber security agency had already identified “a vulnerability in software supplied by a Danish company and has contacted the vendor.” “It is liaising with its European counterparts, as other countries may be affected,” and is seeking “to identify other French companies involved in order to alert them” and “prevent the spread,” the source added. The chief executive of Cooperative U, Dominique Schelcher, described the attack as “unprecedented” and confirmed the cyberattack had affected refrigeration systems since Sunday night. “Targeting equipment essential to the preservation of fresh products and to the food supply of the French people is extremely serious and is unprecedented. It is unacceptable,” he wrote on X. He added that the company’s teams were “fully mobilised” to restore the situation as quickly as possible. “An investigation will be necessary to shed full light on this attack,” he added. The office of the Paris prosecutor confirmed to AFP that an investigation has been opened into “the large-scale cyberattack affecting the refrigerators of several major food retail chains across France.” The probe will help “identify the victims and establish the link with the damage they reported in terms of foodstuff losses and the outbreak of fires,” the prosecutor’s office said. Intermarche condemned the food waste and financial losses resulting from the attack, without providing figures. BFM TV said temperatures were “altered remotely, resulting in the destruction of stocks of fresh and frozen products.” Rising fears of hybrid attacks The incident comes against the background of growing concern over the potential havoc that can be caused in Europe in all sectors by malicious actors carrying out cyberattacks. President Emmanuel Macron, a strong supporter of Ukraine in its fight against the Russian invasion, last month ordered measures to protect France’s critical infrastructure from Russian “hybrid attacks.” Industrial equipment such as refrigeration units, long isolated from the internet, are now connected via sensors or remote monitoring systems, Antoine Hautin of cybersecurity consultancy Almond told AFP. By likely affecting hundreds of units simultaneously, the attack demonstrated “a certain level of sophistication,” he added.
