Hackers Turn French Supermarket Freezers Into Ovens in Coordinated Cyberattack

Just before midnight last Sunday, digital thermostats regulating hundreds of supermarket cold aisles across France began to malfunction, with temperatures spiking unpredictably.

In what officials described as a “bizarre and unprecedented” cyberattack, intruders remotely seized control of temperature settings across thousands of freezers, refrigerators, and chiller cabinets, driving them from as low as -27°C (-16.6°F) to above 50°C (122°F).

Over the following four to six hours, stored food first thawed and then slowly began to cook.

Employees arriving early to restock shelves described being hit by a blast of hot air, similar to opening an oven, when they opened freezer units. A supermarket in Normandy reported several freezers reaching 80°C (176°F). In some locations, the extreme heat sparked fires, activating sprinklers and causing water damage.

“It was a catastrophe,” said an employee at a large Intermarché in Issy-les-Moulineaux, a southwestern suburb of Paris. “They drove our freezers up to 62°C. Everything had to be thrown away. It was an enormous waste.”

After discarding tons of spoiled goods, staff at the store worked until nearly midnight on Monday to reorder and restock. “Thankfully, we were able to restore operations almost to normal the same day,” another worker added. “But we had to clear out everything in the freezers.”

Store managers initially suspected an isolated equipment failure, but it quickly became apparent that as many as 700 locations—including Intermarché, Coopérative U, Carrefour, Leclerc, and Monoprix, along with several independent grocers—had fallen victim to a cyberattack.

Dominique Schelcher, president of Coopérative U, said 80 of its 2,000 supermarkets were affected. “This is a completely unprecedented, unexpected, and extremely serious attack,” the executive told French radio. “In my entire professional career, I have never seen anything like it.”

The Paris public prosecutor’s office immediately launched an investigation into the incident, the latest in a string of cyberattacks that have made France the most frequently targeted country in Europe.

Gérôme Billois, a partner at cybersecurity and technology firm Wavestone, said the breach bore the hallmarks of political sabotage.

“The two most plausible scenarios are either a group of youngsters or activists seeking to demonstrate their capabilities by disabling a few freezers, or a destabilizing sabotage operation carried out by internal or external state actors,” he said.

“Regarding the attack’s signature, the most likely scenario remains a destabilization operation—one intended to signal to the public that they are unsafe, create the impression that the government is collapsing, and ultimately instill fear.

“Currently, two nation-states are known for this type of activity: Iran and Russia.”

The attackers had compromised controllers supplied by Danish firm Danfoss, which manages supermarket freezers and refrigerators. Most cold aisles are internet-connected to permit remote maintenance and failure alerts. Preliminary findings indicate the hackers disabled alarm systems before adjusting thermostats, or extended defrost cycles by several hours to avoid detection.

Danfoss said it had identified security vulnerabilities last year and had “long recommended” that customers install updates or replace obsolete, unsupported systems. The affected units were “running outdated firmware,” the company stated. In the days following the initial attacks, France’s cybersecurity alert agency ANSSI confirmed that supermarkets using controllers from two additional vendors were also targeted.

Marta Rybczyńska, a cybersecurity specialist and researcher, said she had uncovered prior security warnings regarding older supermarket freezers running outdated software, as well as newer models that had not received firmware updates.

“Some of these freezers had not been supported by manufacturers for years, with notices advising replacement,” Rybczyńska said. “Others were newer but had not received software updates.”

She added: “Many of the freezers appear to have been operating with default passwords. The hackers were able to alter or disable alerts, so stores only discovered the damage when the first employee arrived in the morning.”

The latest French cyberattack mirrors a similar incident in the United States in August, when connected refrigerators and freezers at a dozen military commissaries—on-base food stores—underwent unscheduled defrost cycles overnight, resulting in massive food losses.

According to cybersecurity and risk management firm Upguard, France is the most heavily targeted country in Europe by volume of records exposed to hackers.

Over the past three years, hackers have breached France’s healthcare system, France Travail—the government jobseekers agency—the National Agency for Identity Documents (ANTS), and most major mobile carriers. This summer, the economy and finance ministry lost the personal and tax records of 678,000 taxpayers in a series of cyberattacks.

Billois said France has lagged in addressing cybersecurity and has yet to adopt the EU’s Cyber Resilience Act (2024), which mandates security standards for internet-connected devices.

“It is a non-political measure that everyone agrees on, but its passage is delayed by more urgent legislation or disputes over amendments,” he said. “This has been a disaster.”

In the United Kingdom, the Cyber Security and Resilience (Network and Information Systems) Bill is making a similarly tortuous journey through Parliament. However, it does not directly cover the food industry.

Schelcher was quick to shift blame to unnamed refrigeration contractors responsible for maintaining cold-aisle equipment. “Our supermarkets are not Danfoss customers,” he told RTL radio.

To date, no individual or group has claimed responsibility for the supermarket cyberattack. Paris prosecutors have assigned detectives from their anti-cybercrime unit, but Billois said identifying the perpetrators will take time.

“It is possible they will eventually be identified, but it could take weeks or even months to be certain, because hackers know how to cover their tracks,” Billois said.

Rybczyńska added: “Whether the hackers can be traced depends on their level of capability. If it is a handful of amateurs, it is easier because they likely did not think to remove their traces. If they are professionals, it is more complicated and will take longer. If they are based in a foreign country, it will be extremely difficult.”

The total cost of the cyberattack has yet to be calculated, but Thierry Cotillard, CEO of Intermarché, said losses could reach “tens of millions of euros”—an amount grocery companies say is unlikely to be covered by insurance.

“It is a bizarre story,” Billois added. “Responsibility is shared between the supermarkets, the refrigeration subcontractors who maintain the equipment, and the software provider. We cannot assign blame except, of course, to the hackers.

“Ultimately, it comes down to freezers connected to the internet without adequate security. That must serve as a wake-up call to everyone.”

Source link