Hackers took control of refrigeration systems at hundreds of French supermarkets overnight Sunday, sparking fires and forcing stores to throw out fresh and frozen food.
The attack hit at least 300 Intermarché or Netto stores and more than 100 Coopérative U outlets, with several E.Leclerc stores also targeted. Carrefour said the hackers went after 80 of its roughly 6,000 stores. Intermarché said affected stores must discard all fresh and frozen stock, and its chief executive estimated losses at tens of millions of euros in a single day.
Controllers heated fridges to 50 C (122 F) for about six hours at Intermarché, according to one account that put the number of affected Intermarché stores near 150. French media reported the hackers remotely triggered forced defrost cycles. Paris prosecutors confirmed the attack started fires at several stores. The prosecutor’s office opened an investigation and called the attack “large-scale.”
ANSSI, the French cybersecurity agency, identified a vulnerability in software from Danish manufacturer Danfoss. Danfoss said the affected equipment was mostly older hardware that no longer gets software or security updates, and that some units ran outdated firmware.
The company acknowledged incidents in France involving a small number of its refrigeration controllers and did not say how many systems the hackers compromised. Cybersecurity firm Claroty had published research on August 9 describing Danfoss flaws that could let attackers get around authentication. Coopérative U chief executive Dominique Schelcher called the attack “unprecedented.”
Sponsored · Selkirk Copper Mines
France is working with other European governments and looking for other French firms the hackers may have hit. Authorities have not identified the attackers, and no report links the attack to a state or any other group.
It was a busy weekend for cyber incidents in Europe. Ahold Delhaize said Monday it took some systems offline over a security issue, which disrupted Albert Heijn and its US brands. TFG London, owner of Hobbs, Whistles and Phase Eight, identified its own incident on Sunday. No report links either company to the French attack.
