French Supermarket Chains Suffer Cyber-Attack on Danfoss Refrigeration Systems
Hackers targeted outdated Danfoss software to trigger forced defrost cycles, damaging stock at Carrefour, Intermarché, and Coopérative U stores.
Key points
- Coopérative U, Intermarché, Carrefour, and Monoprix confirmed cyber-attacks affecting refrigeration systems starting October 11.
- Attackers compromised outdated Danfoss software versions with unsecured remote-control channels to force defrost cycles.
- Intermarché reported 150 affected stores, while Carrefour cited 80 impacted locations out of its 6,000-store network.
Major French supermarket chains confirmed a cyber-attack targeting refrigeration infrastructure beginning on October 11. The incident disrupted temperature controls at multiple retail locations, leading to significant food spoilage across several major grocery brands operating in France.
Dominique Schelcher, CEO of Coopérative U, stated on October 12 that the attack affected several stores in the network from the previous day. He described the incident as unprecedented and unacceptable, noting that refrigeration systems are essential for preserving fresh products. Cooperative U teams are currently working with specialists to restore operations.
Technical Context and Attack Vector
BFMTV reported that the compromised systems are administered by Danish provider Danfoss. An Intermarché spokesperson confirmed that attackers targeted outdated versions of the manufacturer’s freezing and refrigeration control software. The vulnerable consoles featured remote-control capabilities but lacked adequately secured communication channels.
Hackers reportedly triggered forced defrost cycles in the refrigeration units, programming temperatures to reach as high as 50 degrees Celsius. This extreme temperature shift caused rapid spoilage of perishable goods. The attack involved consoles with remote-control capabilities that lacked an adequately secured communication channel.
Scope of Impact and Losses
Intermarché confirmed that 150 of its stores were affected by the cyber-attack. The chain estimated financial losses at thousands of euros, though it stated it was impossible to estimate the total volume of wasted food. Two specific supermarkets, an Intermarché and a Super U in Haguenau, recorded merchandise losses of €270,000.
Carrefour reported that the incident primarily affected 80 out of its 6,000 stores. Groupe Casino stated that 5 percent of its Monoprix supermarkets were impacted by the attack. Coopérative U, which operates Hyper U, Super U, U Express, and Utile brands, also confirmed disruptions across its retail cooperative network.
What should you do?
Organizations managing critical infrastructure should immediately audit third-party software dependencies for outdated versions. Security teams must verify that remote management interfaces use encrypted communication channels and strong authentication. Incident response plans should include procedures for rapid temperature restoration in case of environmental control failures.
What to do and how to stay safe: Danfoss
- Inventory all third-party industrial control software and verify that versions are current and supported by the vendor.
- Ensure remote access points for critical systems use encrypted channels and multi-factor authentication to prevent unauthorized control.
- Monitor system logs for anomalous temperature changes or unexpected defrost commands in refrigeration and HVAC systems.
- Establish clear communication channels with hardware vendors to receive immediate alerts regarding security vulnerabilities in control software.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which supermarket chains were affected by the cyber-attack?
Coopérative U, Intermarché, Carrefour, and Monoprix confirmed that their stores were impacted by the attack on refrigeration systems.
How did the attackers compromise the refrigeration systems?
Attackers targeted outdated versions of Danfoss software with unsecured remote-control channels, forcing defrost cycles to high temperatures.
What was the estimated financial loss from the attack?
Intermarché estimated losses at thousands of euros, while two stores in Haguenau recorded €270,000 in merchandise losses.
