Cyberattack on French supermarkets causes food spoilage and fires

Consensus Summary

A coordinated cyberattack forced temperatures in French supermarket refrigerators to rise as high as 50 degrees Celsius, causing widespread food spoilage, fires, and financial losses across hundreds of stores. The attack, confirmed by the Paris prosecutor’s office, targeted major retailers including Carrefour, Monoprix, and Intermarché, with Carrefour reporting 80 affected stores and Monoprix noting 5 per cent of its approximately 490 locations were impacted. Intermarché alone discarded food worth tens of millions of euros nationwide in a single day, while similar disruptions were reported at about a dozen US military commissaries in late August. The incident began on August 9, when vulnerabilities in Danfoss refrigeration software were exploited, allowing hackers to remotely alter temperature settings overnight for up to six hours.

The attack underscores the growing risks of cyber threats to critical infrastructure, particularly in sectors reliant on interconnected digital systems. Danfoss, the Danish company supplying the affected software, acknowledged the incidents and emphasized the importance of updating firmware, stating that affected units were running outdated systems. The French government, through Prime Minister Sebastien Lecornu, instructed the National Cybersecurity Agency (ANSSI) to investigate, while the French retail association demanded transparency from Danfoss. The incident also raised concerns about supply chain resilience, as retailers like Cooperative U and E.Leclerc were forced to discard perishable goods to mitigate health risks, with some stores already resuming operations.

Key figures in the response included Intermarché CEO Thierry Cotillard, who described the attack as 'unprecedented' and estimated losses in the tens of millions of euros, and Cooperative U CEO Dominique Schelcher, who called the targeting of refrigeration systems 'extremely serious.' The Paris prosecutor’s office opened an investigation to identify victims and assess damages, including food losses and fires. Meanwhile, Dutch retailer Ahold Delhaize, which operates Albert Heijn and major US chains like Stop & Shop, reported a cybersecurity incident causing its websites to display 'site temporarily down' notices, though it denied a direct link to the French attacks. Online grocery orders for Albert Heijn, which account for about 10 per cent of sales, were disrupted as a precaution.

While ABC, 7NEWS, and the Guardian largely agree on the scale and impact of the attack, discrepancies emerge in specific figures and details. ABC and 7NEWS both report that about 150 Intermarché stores were affected, but the Guardian estimates a broader range of 150-200 shops, along with almost 100 Cooperative U outlets, a figure not explicitly confirmed by the other sources. Additionally, ABC provides a more detailed breakdown of affected retailers, including E.Leclerc and Auchan, while the Guardian highlights the attack’s timing beginning on Sunday night, a detail absent from the other reports. The Guardian also notes that E.Leclerc was reportedly affected but did not confirm the information, adding another layer of uncertainty to the scope of the incident.

As investigations continue, the focus remains on identifying the attackers and assessing the broader implications for cybersecurity in retail and critical infrastructure. The French government’s coordination with European counterparts suggests the threat may extend beyond national borders, particularly given the similar disruptions in the US. Experts warn that outdated software and centralized refrigeration systems could leave other retailers vulnerable, prompting calls for greater investment in cybersecurity measures. While some stores have already resumed operations, the long-term impact on consumer trust and industry practices remains unclear, with retailers like Woolworths and Coles in Australia reportedly monitoring the situation for potential copycat attacks.