Cyberattack Spoils Food at Hundreds of French Supermarkets via Refrigeration Controllers
Attackers remotely triggered defrost cycles at Intermarché, Netto and Coopérative U stores, disrupting cold storage across France overnight Sunday.
Key points
- The attack disrupted refrigeration at approximately 300 Intermarché and Netto stores and fewer than 100 Coopérative U locations.
- Attackers remotely activated the defrost function on Danfoss-managed controllers, causing fresh food to spoil.
- France’s ANSSI is coordinating with European counterparts, while the vendor has not publicly confirmed involvement.
Attackers remotely triggered defrost cycles on refrigeration units at hundreds of French supermarkets overnight Sunday, spoiling fresh inventory. Retailers confirmed the cyberattack disrupted cold storage facilities across several major grocery chains, according to French media reports.
French broadcaster BFMTV reported that the incident affected approximately 300 stores operated by Intermarché and Netto, along with fewer than 100 locations belonging to Coopérative U. The attackers manipulated the systems to halt cooling, compromising the integrity of perishable goods.
System Details and Vendor Response
BFMTV identified the affected hardware as refrigeration controllers manufactured by Danfoss, a Danish company. The reports indicated that the attackers targeted older versions of the software running on these devices. Groupement Mousquetaires, the parent company of Intermarché and Netto, stated that Danfoss manages these systems.
The group indicated that the supplier would be responsible for filing a criminal complaint regarding the incident. Danfoss has not publicly confirmed that its systems were the specific target of this attack. A spokesperson for the manufacturer did not immediately respond to requests for comment following the breach.
Official Coordination and Historical Context
France’s national cybersecurity agency, ANSSI, issued an emailed statement confirming it was mobilized to handle the incident. The agency said it was supporting potential victims at the national level and coordinating with European counterparts. Dominique Schelcher, chief executive of Coopérative U, confirmed the attack began affecting cold production facilities the previous night.
Schelcher described the targeting of essential food preservation equipment as unprecedented and unacceptable. He noted that his teams were working with refrigeration specialists to restore normal operations as quickly as possible. Security researchers have previously flagged weaknesses in Danfoss controllers.
Last year, the U.S. Cybersecurity and Infrastructure Security Agency published an advisory regarding three vulnerabilities in these devices. Researchers at Claroty’s Team82 later demonstrated that a compromised controller could switch off cooling while reporting normal temperatures. They counted more than 2,700 of these devices exposed to the internet. It is not known whether those specific flaws were used in Sunday’s attack.
What should you do?
Organizations managing industrial control systems should verify the integrity of their refrigeration and HVAC controllers immediately. Operators should monitor for unexpected defrost cycles or temperature discrepancies that do not match physical sensor readings. Network administrators should review access logs for remote connections to older software versions that may lack recent security patches.
What to do and how to stay safe: Danfoss
- Audit all connected industrial control systems for unauthorized remote access or unusual command executions.
- Verify physical temperature readings against digital reports to detect discrepancies caused by manipulated sensors.
- Isolate older software versions of critical infrastructure controllers from the internet until security is confirmed.
- Monitor vendor communications for specific advisories regarding the software versions affected by this incident.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which supermarket chains were affected by the cyberattack?
The attack affected approximately 300 Intermarché and Netto stores, as well as fewer than 100 Coopérative U locations.
Did Danfoss confirm its systems were targeted?
Danfoss has not publicly confirmed that its systems were the target, and a spokesperson did not respond to comment requests.
How did the attackers disrupt the refrigeration units?
Attackers remotely triggered the defrost function on the controllers, causing cooling to stop and fresh food to spoil.
