Hackers heat supermarket freezers across France, spoiling food and sparking fires

Hackers remotely took over the temperature controls of refrigerators and freezers at hundreds of French supermarkets last week. They heated the units to as much as 50C, which spoiled stock worth millions of euros and caused fires in some stores.

The Paris public prosecutor’s office has opened an investigation into what it called a “large-scale cyber-attack affecting the refrigerators of several major food retail chains across France”. A person in Prime Minister Sebastien Lecornu’s office said he had told the National Cybersecurity Agency (ANSSI) to investigate. No individual or group has claimed responsibility.

Carrefour said 80 of its stores were hit, and Monoprix said 5 per cent of its shops were affected. Les Mousquetaires, which owns Intermarché and Netto, said 180 stores were affected and another 100 were urgently disconnected from the internet. Coopérative U, E.Leclerc and some independent shops were also targeted. Estimates of the total range from 400 stores to as many as 700.

Staff arriving to restock on Monday morning said opening the freezers released a blast of hot air. “They pushed the freezers here up to 62C. Everything had to be thrown away,” said a worker at an Intermarché in Issy-les-Moulineaux, south-west of Paris. One store in Normandy reported freezers at 80C. In some shops, fires set off the sprinklers.

Most supermarket cold aisles are run by control panels that manage all of a store’s fridges and freezers. These panels are connected to the internet so that maintenance contractors can adjust them remotely and receive alerts when something fails. A source close to Lecornu said ANSSI had found a vulnerability in software supplied by the Danish company Danfoss. ANSSI later confirmed that controllers from two other companies had also been targeted.

Danfoss said the affected units “were running outdated firmware”. It said it had “long advised customers to keep supported systems updated with the latest firmware and to migrate legacy systems to current-generation solutions”. On August 9, Team82, the research unit of the cybersecurity firm Claroty, published details of flaws in the Danfoss AK-SM 800A controller that could let attackers bypass authentication and run code on the devices. Danfoss had issued updates to fix them.

The cybersecurity researcher Marta Rybczyńska said some of the freezers had not been supported by their manufacturers for years. Others were newer but had not been updated, and “many of the freezers appear to have been running with a default password”. Early findings suggest the attackers turned off the alarm systems, or extended the overnight defrost cycle by several hours, so stores found out only when staff arrived.

Gérôme Billois, a partner at the consultancy Wavestone, said there were two likely explanations. It was either “a group of youngsters or activists who wanted to blow up a few freezers to prove what they could do”, or sabotage by state actors. He said the most likely was a destabilisation attack intended “to instil fear”. He added: “Currently there are two international actors known for doing this sort of thing: Iran and Russia.”

Felix Aime, a senior analyst at Sekoia, said Spain, Portugal, Poland, Germany and Belgium had also been affected. France is co-ordinating with its European counterparts. The attack resembles an incident in late August, when fridges at a dozen US military commissaries went into unscheduled defrost cycles.

Thierry Cotillard, chief executive of Intermarché, told BFMTV that losses could reach “tens of millions of euros nationwide in a single day”. The broadcaster said two stores in Alsace had reported losses of €270,000 between them. Retailers said insurance was unlikely to cover the damage.

Questions are already being asked who is responsible. Dominique Schelcher, president of Coopérative U, pointed to the refrigeration contractors who maintain the equipment. “Our supermarkets are not customers of Danfoss,” he said. The retail federation FCD called for “full transparency” from Danfoss. Billois said responsibility was shared between the supermarkets, their contractors and the software company.

Finding the attackers may take time. Billois said it “could take weeks if not months to be certain because hackers know how to hide their tracks”. Rybczyńska said that if the attackers are in a foreign country, “it’ll be extremely difficult”.

Regulation is also likely to come up. Billois said France had still not adopted the EU’s 2024 Cyber Resilience Act, which made security mandatory for internet-connected devices, and that the delay “has been a disaster”. European Food Commissioner Christophe Hansen said: “Food security requires more attention at all levels. Because the weaponisation of food has become a reality.”

The FCD said some affected stores were already back in operation.