Hackers have launched a large-scale cyberattack against connected refrigeration systems at hundreds of supermarkets across France and at least five other European countries, raising freezer and refrigerator temperatures to as high as 50 degrees Celsius and sustaining them at that level overnight for approximately six hours, causing widespread food spoilage, fires and losses estimated in the tens of millions of euros in a single day. The Paris prosecutor’s office confirmed the attack was affecting connected refrigerators across several major French food retailers, with Carrefour reporting 80 stores hit, Intermarché operator Les Mousquetaires confirming approximately 150 affected stores, and Monoprix reporting disruption at five percent of its roughly 490 French locations. Cooperative U, E.Leclerc and Auchan were also named or approached in connection with the incident. French Prime Minister Sebastien Lecornu instructed the national cybersecurity agency ANSSI to investigate, with France coordinating with European counterparts after confirmation that Spain, Portugal, Poland, Germany and Belgium had also been affected. Staff at affected stores discarded all compromised food products to eliminate health risks, with eyewitnesses in Paris describing supermarket workers disposing of cartloads of defrosted frozen food, with molten ice cream spilling onto the street from broken containers.
ANSSI identified the vulnerability exploited in the attack as residing in software supplied by Danish industrial technology company Danfoss, specifically in refrigeration management systems running outdated firmware. Danfoss confirmed it was aware of incidents affecting a limited number of its refrigeration management systems and stated that the affected units were running outdated firmware, noting that it had long advised customers to keep systems updated and migrate legacy installations to current-generation solutions. The vulnerability had been publicly documented on 9 August when a cybersecurity firm published research detailing flaws in the Danfoss AK-SM 800A controller, including issues that could allow attackers to bypass authentication controls and execute code on compromised devices, with Danfoss software updates having addressed those issues prior to the attack. Supermarket cold aisles typically operate through centralised control panels managing an entire store’s refrigeration infrastructure that are accessible over the internet to allow maintenance companies to make remote adjustments, a convenience that created the attack surface exploited in this incident. The French retail association Fédération du Commerce et de la Distribution called on Danfoss for full transparency about the incident and the extent of the vulnerability.
The attacks bear strong resemblance to disruptions reported at approximately a dozen United States military commissaries in late August that similarly resulted in food losses through refrigeration tampering, raising the possibility of a connected threat actor or shared methodology.