A large-scale cyberattack targeted refrigeration systems at hundreds of French supermarkets, forcing retailers to discard spoiled food. Authorities are investigating software vulnerabilities as similar disruptions emerge across Europe.
Hackers raised temperatures inside refrigerators and freezers at hundreds of supermarkets across France to as high as 50°C, triggering fires and causing widespread food spoilage in a major cyberattack that disrupted several leading retail chains.
The Paris prosecutor’s office said on Monday that a “large-scale” cyberattack was “affecting connected refrigerators in several major food retailers across France,” resulting in food losses and fires.
Prime Minister Sebastien Lecornu directed France’s National Cybersecurity Agency (ANSSI) to investigate the incident, according to a source in his office.
French authorities are also coordinating with European counterparts to assess the possibility of similar attacks in other countries and determine whether additional domestic companies remain vulnerable, CNN reports.
Hundreds Of Supermarkets Affected Across Europe
Felix Aime, a senior cyber threat intelligence analyst at Sekoia Threat Detection and Research, said Spain, Portugal, Poland, Germany and Belgium had also been affected.
French retail giant Carrefour confirmed that 80 of its supermarkets were hit, while Monoprix said 5% of its approximately 490 stores had been affected.
Les Mousquetaires, which owns Intermarche, reported that refrigeration systems at around 150 stores were heated to 50°C for six hours overnight. The company said all affected food had been discarded to prevent health risks.
At an Intermarche supermarket in central Paris, resident Geert de Clercq witnessed employees throwing cartloads of defrosted food into a large rubbish container, with melted ice cream spilling from damaged tubs onto the street.
Cooperative U CEO Dominique Schelcher confirmed that his supermarket group had also been targeted.
“Targeting equipment essential to the preservation of fresh products and to the food supply of the French people is of extreme gravity and is unprecedented,” he wrote on X.
Other major retailers, including E.Leclerc and Auchan, did not respond to requests for comment.
Although the total financial damage remains unclear, Intermarche CEO Thierry Cotillard told BFM TV that the “unprecedented” attack could cause losses amounting to “tens of millions of euros nationwide in a single day.”
Christel Delberghe, director general of European retail association Eurocommerce, said, “This incident underlines the importance of resilience across the entire supply chain.”
Outdated Software Suspected Behind Refrigeration System Breach
Supermarket refrigeration systems are generally operated through central control panels that regulate temperatures across an entire store. These systems can be accessed remotely over the internet, allowing maintenance companies to adjust settings without visiting the premises.
A source close to Lecornu said ANSSI had identified a vulnerability in software supplied by Danish company Danfoss.
The company acknowledged the incidents, saying it was “aware of incidents in France affecting a limited number of refrigeration management systems”.
Danfoss said the affected units “were running outdated firmware,” adding that it had “long advised customers to keep supported systems updated with the latest firmware and to migrate legacy systems to current-generation solutions.”
On August 9, cybersecurity firm Claroty’s Team82 published research identifying vulnerabilities in the Danfoss AK-SM 800A controller.
According to the research, Danfoss had issued software updates to address weaknesses that could allow hackers to bypass authentication controls and execute code on compromised devices.
The incidents resemble disruptions reported at around a dozen US military commissaries in late August, where refrigeration failures resulted in food losses.
French retail association Fédération du Commerce et de la Distribution (FCD) demanded “full transparency” from Danfoss regarding the attack.
The association said supermarkets were working to protect consumers and restore normal operations, with some affected outlets already resuming services.
Also Watch:
Dutch Retailer Reports Separate Cybersecurity Incident
Meanwhile, Dutch retailer Ahold Delhaize, which operates the Netherlands’ largest supermarket chain Albert Heijn and has significant operations in the US, reported a separate “security issue” affecting its network.
The company took several systems offline as a precaution, while a notification on Albert Heijn’s smartphone application informed customers that grocery deliveries were unavailable because of a “cybersecurity incident”.
Online orders account for approximately 10% of Albert Heijn’s sales. Although physical stores remained open, Dutch news agency ANP reported that competing retailers experienced increased demand for delivery services.
Ahold Delhaize said there was no reason to believe its cybersecurity incident was connected to the attacks in France.
The company, which is the fourth-largest grocery retailer in the US, also experienced website disruptions across its Stop & Shop, Giant, Hannaford and Food Lion chains. Their websites displayed notices stating “site temporarily down”.
