Hackers disrupt refrigeration at 700 French supermarkets, trigger substantial food losses

New Delhi: A cyberattack targeting internet connected refrigeration systems affected around 700 supermarkets across France, forcing several stores to discard spoiled food and prompting an investigation into reports of fires and equipment damage. The disruption began overnight on October 11-12, with further attacks targeting other refrigeration controllers reported the following night.

Hackers reportedly manipulated refrigeration settings and prolonged defrost cycles, causing temperatures in some units to climb as high as 50-degrees celsius. Supermarkets unable to maintain safe temperatures removed fresh and frozen products from sale, although not every affected outlet experienced a complete refrigeration failure.

France’s finance minister, Roland Lescure, told parliament on Tuesday that around 700 of the country’s 10,000 supermarkets had been affected. He said national food supplies were not at risk but acknowledged the seriousness of the incident.

The Paris prosecutor’s office has opened a cybercrime investigation covering food losses, equipment damage and reported fires. Authorities have not released a consolidated damage assessment.

Major supermarket chains face substantial food losses

French retail group Groupement Mousquetaires confirmed that approximately 300 Intermarche and Netto stores were affected, with some refrigerated display cases remaining out of service on Tuesday.

Cooperative U reported disruptions at 80 of its approximately 2,000 stores. Most managed to prevent serious refrigeration problems, although some were forced to discard food.

“Targeting equipment essential to the preservation of fresh products is an attack on the French food supply chain,” the company’s chief executive, Dominique Schelcher, said.

Carrefour and Monoprix stores were also affected, alongside individual E.Leclerc supermarkets, demonstrating that the disruption extended across multiple retail networks.

Intermarche chief executive Thierry Cotillard estimated that nationwide losses could reach tens of millions of euros, although no final industry wide assessment is available.

At an Intermarche supermarket in Gradignan, southwestern France, the owner reported approximately €21,000 in lost stock. Equipment at another store in La Haye reportedly melted after temperatures climbed to 80 degrees Celsius, according to Le Monde.

Cybersecurity agency identifies controllers

France’s national cybersecurity agency (ANSSI) identified widespread compromises involving refrigeration management systems manufactured by Denmark’s Danfoss and US based Copeland, including equipment marketed under the Dixell brand.

An official security advisory updated on Tuesday identified Danfoss AK-SM and AK-SC controllers alongside Copeland and Dixell XWeb systems. Authorities warned that attacks could still be underway.

These internet-connected controllers allow maintenance teams to monitor temperatures, regulate defrost cycles and manage refrigeration equipment remotely.

However, management interfaces exposed to the public internet can allow unauthorized access when security protections are inadequate.

Danfoss acknowledged that most affected systems were older products no longer receiving software or security updates. Copeland separately confirmed a vulnerability involving a discontinued generation of controllers and said it was working with affected customers.

Cybersecurity company Claroty had identified authentication and software weaknesses in Danfoss AK-SM 800A controllers in research published in August. The manufacturer subsequently addressed those vulnerabilities, but investigators have not established whether the same flaws were exploited in the French attacks.

The disruption extended beyond the initial Danfoss incidents. Refrigeration in the intervening night of October 12 and 13, including an incident near Bordeaux where technicians intervened before food specialists reported further attacks on Dixell-equipped stores d stocks were lost.

No group has claimed responsibility, and no ransom demand has been reported. French cybersecurity authorities have advised operators to isolate exposed controllers, install available security updates and restrict remote access while investigators work to establish who carried out the attacks.