Cyberattack Disrupts French Supermarkets as Refrigerators Reach 50°C

The Paris prosecutor’s office said on Monday that a “large-scale” attack was affecting connected refrigeration systems operated by several major food retailers, resulting in food losses and fires. French Prime Minister Sébastien Lecornu has directed the country’s National Cybersecurity Agency (ANSSI) to investigate the incident.

Authorities are also coordinating with European counterparts to determine whether the attack has affected businesses in other countries and whether additional French companies could be at risk.

Felix Aime, a senior cyber threat intelligence analyst at Sekoia Threat Detection and Research, said the incident had also affected Spain, Portugal, Poland, Germany and Belgium.

Several major French supermarket chains reported disruptions. Carrefour said 80 of its stores had been affected, while Monoprix reported incidents at approximately five per cent of its nearly 490 outlets.

Les Mousquetaires, the group that owns Intermarché, said refrigeration units at around 150 stores had reportedly been heated to 50°C for approximately six hours overnight. The company said all affected food had been discarded as a precaution to protect consumers from potential health risks.

The scale of the disruption was visible at an Intermarché outlet in central Paris, where staff were seen disposing of large quantities of thawed frozen food. Witnesses described carts of spoiled products being dumped into a large waste container, with melted ice cream spilling onto the street.

Cooperative U chief executive Dominique Schelcher also confirmed that his supermarket group had been targeted.

In a post on X, Schelcher described the targeting of equipment essential to preserving fresh food and maintaining France’s food supply as extremely serious and unprecedented.

The financial impact of the incident remained unclear, although Intermarché chief executive Thierry Cotillard told French broadcaster BFM TV that nationwide losses could reach tens of millions of euros in a single day.

Christel Delberghe, director general of European retail association EuroCommerce, said the incident highlighted the need to strengthen resilience throughout the supply chain.

Internet-Connected Refrigeration Systems Under Scrutiny

Supermarket refrigeration systems are often managed through centralised control panels that regulate temperatures across multiple refrigerators and freezers. When these systems are connected to the internet, maintenance providers can monitor and adjust equipment remotely.

A source close to Prime Minister Lecornu said ANSSI had identified a vulnerability involving software supplied by Danish company Danfoss.

Danfoss said it was aware of incidents in France affecting a limited number of refrigeration management systems. The company added that the affected equipment was running outdated firmware and reiterated its advice that customers install supported updates and replace legacy systems with current-generation solutions.

The incident has drawn attention to previously reported vulnerabilities in Danfoss refrigeration controllers. On August 9, cybersecurity firm Claroty’s Team82 research unit published findings concerning vulnerabilities in the Danfoss AK-SM 800A controller. According to the research, software updates released by Danfoss addressed issues that could potentially allow attackers to bypass authentication controls and execute code on compromised devices.

The French incident also bears similarities to disruptions reported at around a dozen US military commissaries in late August, where refrigeration problems reportedly resulted in food losses. However, a direct connection between the incidents has not been established.

France’s retail association, the Fédération du Commerce et de la Distribution (FCD), called on Danfoss to provide full transparency regarding the incident. The association said retailers were working to protect consumers and restore normal operations, adding that some affected stores had already resumed normal functioning.

Dutch Retailer Ahold Delhaize Reports Security Incident

Meanwhile, Dutch retail group Ahold Delhaize said it was responding to a security issue affecting its network and had taken several systems offline as a precaution.

The company operates Albert Heijn, the Netherlands’ largest supermarket chain, as well as major grocery businesses in the United States. A message on Albert Heijn’s smartphone application said grocery deliveries had been suspended because of a cybersecurity incident.

Online orders account for approximately 10 per cent of Albert Heijn’s sales. Although physical stores remained open, Dutch news agency ANP reported that competing retailers had experienced a surge in delivery orders.

Ahold Delhaize said there was no reason to conclude that its security incident was connected to the attacks reported in France.

The group is also the parent company of several major US supermarket chains, including Stop & Shop, Giant, Hannaford and Food Lion. Their websites displayed notices informing customers that the sites were temporarily unavailable.

It remained unclear whether other operations had been affected or whether the incidents in France and the Netherlands were linked.

The developments have renewed concerns about the cybersecurity of internet-connected equipment used in essential commercial operations. Experts have increasingly highlighted the risks posed by outdated software and insufficiently secured systems, particularly when digital disruptions can affect food safety, supply chains and consumers on a large scale.