A large-scale overnight attack

The Paris prosecutor's office said on Monday that a large-scale cyber-attack on French supermarkets had affected connected refrigerators in several major food retailers across France. Hackers raised the temperature of the fridges to 50C overnight, hitting several hundred stores, and reported damage included food losses and fires.

Damage reported across French retailers

Several chains disclosed the impact on their stores:

• •Les Mousquetaires, owner of Intermarché, said about 150 of its stores were hit, with fridges heated to 50C for six hours; all food was thrown away to avoid health risks.
• •Coopérative U said its supermarkets were also hit. Its chief executive, Dominique Schelcher, wrote on X that the attack was of extreme gravity and unprecedented.
• •According to BFM TV, E Leclerc, France's largest supermarket chain, was affected too, with hackers remotely triggering forced defrosting of refrigeration systems in numerous stores; E Leclerc did not respond to a comment request.
• •Carrefour, Monoprix and Auchan did not respond to requests for comment.

Schelcher made the remarks in a post on X.

Government response and Danfoss vulnerability

Prime minister Sébastien Lecornu instructed France's national cybersecurity agency ANSSI to investigate, according to a person in his office. ANSSI's work, as described by a source near the prime minister, has already traced the breach to a flaw in software the Danish firm Danfoss supplies.

Danfoss said it was aware of incidents in France affecting a limited number of refrigeration management systems. The company said the affected units were running outdated firmware, and that it had long advised customers to keep supported systems updated and to migrate legacy systems to current-generation solutions.

Possible wider impact in Europe

France was coordinating with its European counterparts, as other countries may also be affected, and was investigating whether other French firms were at risk.

Separately, the Dutch supermarket company Ahold Delhaize said it was dealing with a security issue in its network and had taken several systems offline to protect them. Its Albert Heijn stores, the largest supermarket chain in the Netherlands with several stores in Belgium, stayed open in both countries, but the online app and delivery system were down, while electronic price tags often displayed the wrong information.

Delhaize supermarkets in Belgium and Luxembourg, also part of Ahold Delhaize, were affected too, Belgian media reported. It was not clear whether the French supermarket attack was linked to the problems flagged by Ahold Delhaize. The ANSSI investigation into the Danfoss software remains under way while France works with European partners.