A massive cyberattack recently targeted connected refrigeration systems across hundreds of French supermarkets, spiking internal temperatures to 50 degrees Celsius. This breach caused widespread food spoilage and fires, prompting an immediate investigation by France's National Cybersecurity Agency (ANSSI).
Tens of millions of euros lost as 150 Intermarché stores heat up
The scale of the disruption is vast, affecting several of France's largest food retailers. According to the report, Intermarché saw refrigerators at approximately 150 stores heat up to 50 degrees Celsius for a six-hour window overnight. Carrefour reported that 80 of its supermarkets were hit,while Monoprix noted that 5% of its store network was affected. Cooperative U CEO Dominique Schelcher described the targeting of food preservation equipment as an "unprecedented" act of extreme gravity.
The financial fallout is expected to be severe. Intermarché CEO Thierry Cotillard told BFM TV that the attack would likely result in losses totaling tens of millions of euros nationwide in a single day. beyond the balance sheet, the physical impact was visceral; witnesses in central Paris reported seeing staff discard entire carts of defrosted food, including molten ice cream, into giant trash containers to prevent health risks.
The Danfoss AK-SM 800A vulnerability and outdated firmware
The technical entry point for the attackers appears to be a vulnerability in software provided by the Danish company Danfoss. As the source reported, ANSSI identified a flaw in the Danfoss AK-SM 800A controller, a device used in control panels that manage store-wide refrigeration via the internet. this connectivity, designed to allow maintenance companies to make remote adjustments, became a liability when hackers bypassed authentication controls.
Danfoss has acknowledged the incidents, stating that the affected units were running outdated firmware. The company emphasized that it had previously advised customers to migrate legacy systems to current-generation solutions. This vulnerability was not a secret; cybersecurity firm Claroty's Team82 had published research on August 9 detailing how attackers could execute code on these compromised devices.
From US military commissaries to the European grocery aisle
This attack is part of a concerning trend where Industrial Internet of Things (IIoT) devices are weaponized to disrupt physical supply chains. The current crisis in France echoes disruptions reported in late August at roughly a dozen US military commissaries, where refrigerators were similarly compromised, leading to significant food losses. This suggests a pattern of attackers targeting specific hardware vulnerabilities across different sectors and geographies.
The geographic reach of this specific breach extends far beyond France. Senior cyberthreat intelligence analyst Felix Aime of Sekoia Threat Detection and Research noted that supermarkets in Spain, Portugal, Poland, Germany, and Belgium were also affected. this cross-border contagion highlights the systemic risk posed by standardized hardware in the global food supply chain.
The disputed link to Ahold Delhaize and the identity of the attackers
While the French crisis is well-documented, the full scope of the attack remains unclear. Dutch retailer Ahold Delhaize, which operates the Albert Heijn chain and major US brands like Stop and Shop and Food Lion, recently took several systems offline due to a security incident. While Ahold Delhaize stated there was no reason to link its network issues to the French attacks, the timing has raised suspicions across the industry.
Several critical details remain missing from the public record. the report does not identify the specific hacking group responsible or their primary motive—whether it was financial extortion or state-sponsored sabotage. Furthermore, major retailers E.Leclerc and Auchan have not yet responded to requests for comment, leaving it unknown if they suffered similar losses to those reported by Intermarché and Carrefour.
Comments 0