Hackers hit French supermarkets in attack disabling fridges, forcing stores to discard food

Around 150 Intermarche supermarket stores were hit by cyberattacks on the night of Oct 11.

Hackers attacked hundreds of French supermarkets on Oct 11 and disabled fridges, forcing stores to throw away meat, frozen food and vegetables.

150 Intermarche stores, fewer than 100 Cooperative U stores and 80 Carrefour sites were hit. Danfoss said it was “aware of incidents in France” and is helping customers.

The attacks raised fears of physical sabotage through “operational technology” systems. Experts said older Danfoss equipment lacked updates, and France is preparing to protect critical infrastructure.

PARIS - Hundreds of supermarkets in France were hit by cyberattacks on the night of Oct 11 that disabled refrigeration systems and forced stores to throw out damaged food, following warnings that hackers are seeking to cause physical damage.

Around 150 Intermarche stores were hit, a spokesman for owner Groupement Mousquetaires told Bloomberg. Hackers accessed cooling systems and set them to defrost, with refrigerators and freezers heating to 50 deg C for around six hours. Meat, frozen items and vegetables had to be tossed out.

Mousquetaires said the systems were managed by Danish refrigeration firm Danfoss and that it would be up to the supplier to file a complaint with the authorities.

Cooperative U was also hit by the cyberattacks, chief executive Dominique Schelcher said on X. Fewer than a hundred of its stores were affected, Agence France-Presse reported. A spokesperson for Carrefour said 80 supermarkets were impacted out of a total of 6,000 sites.

Some Leclerc stores were also targeted, BFM said. Leclerc did not immediately respond to a Bloomberg request for .

Danfoss said it was “aware of incidents in France” and working with customers to implement mitigation measures.

It was not immediately clear who was behind the refrigeration cyberattacks, but the intrusions occurred against a backdrop of disruptive cyberattacks internationally.

Hackers can target physical processes and equipment too

In August, Britain’s National Cyber Security Centre warned that hackers were increasingly seeking to cause physical disruption with their attacks, which it linked in part to increased geopolitical instability. The centre said that such attacks were targeting multiple sectors globally and had been carried out by a range of threat actors.

Hackers are more frequently associated with stealing data and extorting companies. But they can also target what are known as operational technology systems, which control physical processes and equipment, such as machinery or temperature controls in refrigeration systems.

In the US in July, suspected Iranian hackers targeted water facilities in at least seven states and in some cases degraded water operations. Unidentified hackers separately targeted oil and gas tankers this summer, temporarily accessing the propulsion system of a tanker approaching the Texas coast.

In September, French president Emmanuel Macron said that he had instructed his government to prepare a plan to protect France’s critical infrastructure and defence industrial and technological base against drone and cyberattacks. He said the country was facing intensifying hostile actions from Russia .

Muhammad Yahya Patel, virtual chief information security officer and cybersecurity adviser for EMEA at the cybersecurity firm Huntress, said the refrigeration attacks are the type that the security industry has been warning as the “ frontier for sabotage attacks.

“They’ve now been weaponised against food retail infrastructure in one of Europe’s largest economies. The immediate financial consequences are significant and visible.”

Danfoss spokesperson Lars Grubak Lohff told Bloomberg that the majority of the affected products are old technologies, including the company’s AK-SM 800 and AK-SC 355 refrigeration systems, which no longer receive software or security updates.

“Danfoss has long advised customers to keep supported systems updated with the latest firmware and to migrate legacy systems to current-generation solutions,” Lohff wrote.

In August, cybersecurity researchers at Team82, part of Claroty, wrote a report flagging vulnerabilities in Danfoss controllers used to manage refrigeration in supermarkets and other cold storage facilities.

The group said it had found a hidden authentication mechanism that could be used to tamper with the operations of refrigeration systems.

Danfoss sold a €500 million (S$714 million) 5.5-year bond on Oct 12 that drew more than €3 billion of investor bids, according to a person familiar with the matter who asked not to be identified.

The lead managers moved the pricing level by as much as 37 basis points tighter during the process. BLOOMBERG