Hundreds of French supermarkets were hit by a large-scale cyberattack that remotely forced refrigeration systems to defrost, spoiling stock and causing fires at several stores, retailers and officials said on Tuesday.
French supermarkets count the cost
At least 300 Intermarché or Netto shops, more than 100 Cooperative U outlets and 80 Carrefour supermarkets were affected, along with about 5% of Monoprix’s roughly 490 stores and several E.Leclerc stores. Hackers pushed fridge and freezer temperatures as high as 50°C (122°F), forcing stores to throw away fresh and frozen products. Some had reopened by the time of reporting.
Intermarché CEO Thierry Cotillard estimated losses of “tens of millions of euros” nationwide in a single day. Cooperative U CEO Dominique Schelcher called the attack “unacceptable”.
Vulnerability and investigation
France’s cybersecurity agency ANSSI identified a vulnerability in software supplied by Danish company Danfoss. Danfoss said the affected units were running outdated firmware and that it was aware of incidents affecting a limited number of systems. Security firm Claroty had published research in August describing Danfoss vulnerabilities that could let attackers bypass authentication.
The Paris prosecutor’s office described the attack as large-scale, and Prime Minister Sébastien Lecornu ordered the ANSSI investigation. Researchers at Sekoia said Spain, Portugal, Poland, Germany and Belgium were also affected. France’s retail federation called on Danfoss for full transparency.
