The Paris public prosecutor’s office said that hackers overnight raised the temperature in the refrigerators and freezers of hundreds of supermarkets in France to 50°C, causing food to spoil and sparking fires in a number of stores.
Carrefour recorded the attack at 80 supermarkets
The incident affected internet-connected refrigeration equipment at several major grocery chains. Carrefour recorded the attack at 80 of its supermarkets, Monoprix estimated that 5% of its stores were affected, and Les Mousquetaires, owner of Intermarché, said that the refrigerators in around 150 of its stores heated to 50°C for six hours overnight; the company discarded all products.
A Paris resident, Gert de Clerc, described employees at an Intermarché in the city centre hauling trolleys of thawed goods into a rubbish container while ice cream leaked from its packaging. The head of Coopérative U, Dominique Shelcher, also commented on the attack, writing: “The strike against the equipment required to preserve fresh food and supply the French with provisions is extremely serious and unprecedented.”
Supermarket refrigeration equipment is typically managed via controllers accessible from the internet, allowing remote configuration. ANSSI identified a vulnerability in software from the Danish company Danfoss, and Danfoss said: “incidents in France affecting a limited number of refrigeration control systems are known”.
Danfoss reported outdated firmware versions on affected devices
Danfoss added that the affected devices “were running outdated firmware versions” and that the company “has for some time recommended that customers update supported systems to the latest firmware and replace obsolete systems with next-generation solutions”. On 9 August, the Team82 research team at Claroty published a description of vulnerabilities in the Danfoss AK-SM 800A controller; the report said that Danfoss-released updates addressed issues that could allow authentication bypasses and code execution on compromised devices.
Analysts say the attack affected more than just France: Sekoia senior analyst Félix Emme said it touched Spain, Portugal, Poland, Germany and Belgium, and Paris is coordinating checks with European partners. Dutch Ahold Delhaize disconnected parts of its systems; the Albert Heijn app temporarily halted deliveries — online orders represent about 10% of its sales — stores remain open, and the company said it saw no reason to link its incident to the attack in France. Meanwhile, the websites of its US chains reported temporary outages.
