Cyberattack Disrupts Cooling Systems at French Retail Stores
A large-scale attack on internet-connected refrigerators and freezers at major stores in France sent equipment temperatures soaring to 50C and destroyed large quantities of food. French officials said the incident caused tens of millions of euros in losses to the retail sector in a single night and may have affected several other European countries as well.
The Paris prosecutor’s office said major retail companies in France were targeted in the attack. At the direction of French Prime Minister Sebastien Lecornu, the country’s national cyber security agency has been deployed to investigate and contain the threat. French officials are also coordinating with European countries to determine the possible scope of the attack.
Felix Emme, senior analyst at security firm Sequoia, said Spain, Portugal, Poland, Germany and Belgium were also affected by the attacks. In France, Carrefour, Monoprix, Intermarché and Coopérative U have all confirmed that some of their stores were targeted.
Carrefour reported disruptions at 80 branches, while Monoprix said five percent of its stores were affected. Intermarché said the temperature of refrigerators in 150 of its stores reached 50C for six hours. Spoiled food was removed from stores and discarded to prevent health risks.
In Paris, witnesses reported carts full of frozen and spoiled food being taken to rubbish bins. Melted ice cream also spilled out of packaging and flowed along some streets.
Dominique Schelcher, chief executive of Coopérative U, called the incident “unprecedented and very serious” and said targeting food storage equipment could threaten the food security of people in France. Thierry Cotillard, chief executive of Intermarché, also estimated that the attack would cost tens of millions of euros in a single day.
Christel Delberg, director-general of the European trade group EuroCommerce, said the incident highlighted the importance of resilience in Europe’s supply chain. France’s retail and distribution federation also called for full transparency from Danfoss and said protecting consumers and quickly restoring stores to normal operations should be the priority.
Sources close to the French prime minister said a vulnerability in software from the Danish company Danfoss was the main cause of the breach. Danfoss confirmed that the affected systems were using older firmware versions and had previously urged customers to update their software.
The Team82 research group affiliated with Claroty had earlier warned about security flaws in Danfoss controllers. According to the report, these flaws could have allowed attackers to bypass authentication mechanisms and run malicious code.
At the same time as the events in France, Dutch company Ahold Delhaize, owner of the Albert Heijn supermarket chain and the fourth-largest food retailer in the United States, reported a “security issue” on its network. The company temporarily took its online systems offline and suspended internet grocery deliveries; however, a direct link between this incident and the attacks in France has not yet been confirmed.
Some affected branches have resumed operations, but experts say the attack has exposed the vulnerability of Europe’s critical infrastructure to cyberthreats.
