Cyber attack on supermarket refrigerators: millions of euros in losses across France
Hackers hijacked the defrost system of Danfoss refrigerators in more than 300 French stores. Losses have reached several million euros nationally.
Freezers turned into ovens: the cyber attack that devastated retail stocks
In the night of Sunday 12 to Monday 13 October, a cyber attack targeted the refrigeration control systems of Danish manufacturer Danfoss, affecting several major French retail chains, including Intermarché, Netto and Coopérative U. According to lemonde.fr, hackers allegedly hijacked the automatic defrost function of these installations to impose a continuous temperature rise, set at 50 degrees, resulting in massive destruction of fresh and frozen products.
Under normal circumstances, refrigeration installations are programmed to perform two hours of defrosting over a twenty-four-hour period. That night, the function allegedly remained continuously activated for several hours. When the refrigerators and freezers opened in the morning, "a wave of heat escaped", according to a sector source cited by lemonde.fr.
A vulnerability in older versions of Danfoss software
The attack reportedly exploited flaws present in certain versions prior to version 4 of the Danfoss control software. This system equips a very large number of shops in France, which would explain the scale of the disruptions. Beyond the major chains, Metro stores and independent shops—notably butchers—may also have been affected.
In some establishments, the attack began around midnight, leaving several hours for temperatures to rise and making it impossible to save merchandise. In other stores hit later in the night, staff managed to preserve some fresh products.
Haguenau and Wasselone: the most serious cases in Alsace
In Alsace, the toll is particularly severe. In Haguenau, in the Bas-Rhin, the local Intermarché allegedly lost its entire stock of frozen products, for an estimated loss of 50,000 euros. The Leclerc store in the same town would also be affected, without yet having calculated the damage.
In Wasselone, in the same region, another Leclerc store had to dispose of both its frozen and fresh products: the loss is estimated at 220,000 euros. By themselves, two Alsatian supermarkets thus totalled 270,000 euros in losses. On a national scale, the bill could reach several million euros, according to sector sources.
More than 300 Intermarché and Netto stores affected
The Mousquetaires grouping is among the distributors most severely hit. When contacted by BFMTV, the group indicated that 300 stores of its Intermarché and Netto brands were affected—a toll twice as high as initial estimates, which reported 150 points of sale.
"Following a cyber attack that allegedly targeted a service provider for the management of refrigeration systems in stores, certain fresh and frozen equipment is out of service. Intermarché and Netto have taken all necessary precautions to quickly remove products present in this equipment", the grouping stated to BFMTV.
Internal communication from the Intermarché network, dated Monday 12 October and reviewed by lemonde.fr, confirms the existence of a cyber attack that occurred at Danfoss during the night. "Several points of sale appear to be impacted by a loss of their frozen products. Our teams are mobilised and ready to take into account your exceptional orders as a priority", the document addressed to stores states.
Coopérative U for its part indicated that "fewer than a hundred" of its stores had been affected.
Crisis cells and ANSSI intervention
Crisis cells were put in place to work with companies specialising in refrigeration installations and support affected stores. A crisis meeting was scheduled for Monday at 11 o'clock between several service providers in the refrigeration sector, including Axima, specialist in the installation and maintenance of refrigeration equipment, and Danfoss, supplier of the control systems in question.
Called upon by the Prime Minister, ANSSI—the National Agency for Information Systems Security—identified a vulnerability in the Danish company's software and made contact with the publisher. The agency is in contact with its European counterparts, with other countries potentially also being affected, and is seeking to identify other potentially exposed installations.
Internet and physical world: an interconnection with concrete consequences
The incident illustrates strikingly the convergence between connected systems and physical infrastructures. Industrial equipment controlled remotely—here refrigeration systems in hundreds of stores—can now be hijacked to cause direct and massive material damage, without local operators being able to intervene in time. The question of updating software embedded in this equipment, often neglected in industrial environments, is at the heart of this matter.
Source: Google News LU FR