Hackers turn up the heat in refrigerators at hundreds of supermarkets in France, sparking fires and food losses

Major French supermarket chains on Monday said they were hit by a cyberattack that caused their refrigerators to shoot up in temperature in hundreds of stores, forcing spoiled food to be thrown away and raising concerns about food security.

Top retailers E. Leclerc, Intermarché and Cooperative U confirmed to AFP they suffered a cyberattack that Cooperative U’s chief executive described as “unprecedented.”

“Food security requires more attention at all levels,” said the EU’s food and agriculture commissioner Christophe Hansen on X, condemning the attack and saying such “exploitation of food” was now a “reality.”

At least 300 shops of Intermarché or its Netto brand were targeted, along with over 100 Cooperative U outlets, and several E. Leclerc stores, the retailers told AFP in separate statements.

“Targeting equipment essential to the preservation of fresh products and to the food supply of the French people is of extreme gravity and is unprecedented,” Cooperative U CEO Dominique Schelcher wrote on X.

Paris prosecutors confirmed the attack, which reportedly also hit other major chains, and also indicated it had sparked fires.

BFM TV said hackers “managed to remotely trigger the forced defrosting of the refrigeration systems in numerous stores.”

The affected branches will have to “throw away all of the products” that are fresh and frozen, Intermarché told AFP.

Carrefour said 80 of its supermarkets were attacked but that the vast majority of its 6,000 stores were not affected, according to the Reuters news agency.

E. Leclerc confirmed to AFP “that a cyberattack affected one of its refrigeration equipment suppliers,” resulting in “repercussions on the operation of refrigeration systems in several stores.”

A source close to the issue said refrigeration control systems from Danish manufacturer Danfoss were targeted.

Danfoss told AFP in a statement that most of the affected equipment was “legacy” products which “no longer receive software or security updates.”

It said its AK-SM800 and AK-SC355 fridge regulator systems were notably affected, with a version of the former using “outdated firmware.” It added that it had long advised supermarkets to update from those models. Danfoss gave no figures on how many systems were affected.

Dutch supermarket operator Ahold Delhaize, which also has operations in the United States, said it was also dealing with a “security issue” in its network, Reuters reported. A phone app for the retailer told clients that due to a “cybersecurity incident” it was unable to deliver groceries.

“Large-scale cyberattack”

A person close to French Prime Minister Sebastien Lecornu said France’s cybersecurity agency had already identified “a vulnerability in software supplied by a Danish company and has contacted the vendor.”

“It is liaising with its European counterparts, as other countries may be affected,” and is seeking “to identify other French companies involved in order to alert them” and “prevent the spread,” the source added.

The office of the Paris prosecutor confirmed to AFP that an investigation has been opened into “the large-scale cyberattack affecting the refrigerators of several major food retail chains across France.”

The probe will help “identify the victims and establish the link with the damage they reported in terms of foodstuff losses and the outbreak of fires,” the prosecutor’s office said.

Intermarché condemned the food waste and financial losses resulting from the attack, without providing figures.

BFM TV said temperatures were “altered remotely, resulting in the destruction of stocks of fresh and frozen products.”

Rising fears of hybrid attacks

The incident comes against the background of growing concern over the potential havoc that can be caused in Europe in all sectors by malicious actors carrying out cyberattacks.

President Emmanuel Macron, a strong supporter of Ukraine in its fight against the Russian invasion, last month ordered measures to protect France’s critical infrastructure from Russian “hybrid attacks.”

Industrial equipment such as refrigeration units, long isolated from the internet, is now connected via sensors or remote monitoring systems, Antoine Hautin of cybersecurity consultancy Almond told AFP.

By likely affecting hundreds of units simultaneously, the attack demonstrated “a certain level of sophistication,” he added.