Hundreds of French supermarkets were hit by a cyber attack that raised the temperature of refrigerators and freezers, causing millions of euros worth of wasted fresh and frozen food.
Hackers gained control of software that regulates the temperature of refrigeration equipment. According to one of the affected retail chains, in some refrigeration units the temperature rose to 50 degrees Celsius overnight.
The CEO of Coopérative U said several of the chain's supermarkets were hit by an "extremely serious and unprecedented" attack.
The cyberattack affected more than 100 Coopérative U supermarkets, as well as 180 stores of the Intermarché chain and its Netto brand. An Intermarché spokesman said another 100 stores were quickly taken offline to prevent similar attacks.
Carrefour reported that hackers hacked refrigerator control systems in 80 of the chain's 6,000 stores. Monoprix said the attack affected 5% of its more than 400 stores. Products whose safety could not be guaranteed were withdrawn from sale.
In a statement to the BBC, the Mousquetaires group, which owns the Intermarché and Netto chains, said some refrigerated and freezer displays were still out of service on Monday afternoon.
The company stressed that stores have "taken all necessary precautions to remove products from these displays" and employees are working to restock shelves with products "as soon as possible."
According to Reuters, Intermarché said temperatures in refrigerators rose to 50 degrees Celsius on Monday night and remained at that level for six hours. To eliminate the threat to the health of customers, the retail chain threw away all affected products.
Other major retail chains, including Monoprix and E.Leclerc, were also hit by the cyberattack.
The hackers targeted software from the Danish engineering company Danfoss.
It allows retail chains to remotely control refrigeration equipment.
Typically, supermarket freezers go through a short defrost cycle at night, during which the temperature rises slightly. However, hackers caused the equipment to heat up and maintain a high temperature. At the same time, Danfoss did not confirm reports about exactly what temperatures the temperature in refrigerators and freezers could rise to.
Danfoss said the attack targeted outdated refrigeration equipment whose security software could not be updated to protect against a previously identified threat.
The company also said in a statement that it has “long recommended” that businesses keep software up to date on systems for which technical support continues to be provided.
“Reliable operation of refrigeration equipment is critical to our customers’ operations. We remain committed to supporting them and helping to ensure the security and reliability of the systems they use,” the statement said.
The full extent of the cyberattack is unclear. However, data provided by individual retailers suggests that it affected about 400 stores out of about 15,000 supermarkets operating in France.
French TV channel BFMTV published a photo of a freezer in the ice cream department, the display of which showed a temperature of 26.5 degrees Celsius.
Two supermarkets in Alsace reported losses totaling €270,000 (£228,000), according to the TV channel. This means that damage across the country could amount to millions of euros.
French prosecutors have launched a separate cybercrime investigation. The Paris prosecutor's office described the incident as "a large-scale cyber attack on the refrigeration equipment of several large grocery retail chains throughout France."
European Commissioner for Agriculture and Food Christoph Hansen condemned the attack in a post on the social network X.
