French supermarket cyberattack destroys chilled and frozen food

Shoppers at hundreds of French supermarkets face reduced choice following a cyberattack that increased freezer temperatures to destroy frozen and chilled food stocks. 

Hackers manipulated refrigeration controls supplied by Danish manufacturer Danfoss, forcing equipment to heat rather than maintain safe storage temperatures.

The losses from the attacks could amount to several million euros, with the Paris prosecutor's office already launching an investigation into the incident.

Shop managers warn that replacing the ruined products could prove a logistical challenge.

Hundreds of shops were affected overnight on October 11-12, when the hackers struck, causing temperatures to rise to 50C in some cases - making food unsafe to sell.

Intermarché, Netto, Coopérative U, Carrefour, E.Leclerc and Monoprix are believed to be among the affected chains.

Will supermarkets run out of frozen food?

In Haguenau, Bas-Rhin, an Intermarché store had to discard its entire frozen-food range, comprising around 2,000 product lines. Losses are estimated at some €50,000.

The store's chilled-food section was largely spared, with about 5% of products removed.

Managers hope to replenish the frozen-food aisles by the end of the week, but warned that the distribution network could struggle if hundreds of affected supermarkets placed large replacement orders simultaneously.

“We are going to need our distribution centre to keep up with supplies to all the shops,” Théo Pinto dos Santos, a co-manager at an Intermarché store, told L'Est Républicain.

At a nearby E.Leclerc, frozen food and some fresh products, including poultry and cooked meats, also had to be discarded.

In Mirepoix, Ariège, shoppers encountered depleted frozen-food, meat, dairy and delicatessen sections at Super U. The shop warned that some fresh products might be temporarily unavailable.

These reports suggest that the immediate impact is likely to be localised gaps in supermarket ranges, rather than a shortage of food across France.

While the financial impact of the attack is not yet known a source close to the case told France Inter it could amount to several million euros in losses. 

How quickly will stocks return?

Intermarché's owner, Groupement Mousquetaires, said products were removed from affected refrigeration units as quickly as possible and that operations were gradually returning to normal.

However, restoring normal stock levels could take several days while purchasing centres and wholesalers delivered replacement goods to shops, the group told Le Monde.

The extent of the losses varies between the groups. Coopérative U chief executive Dominique Schelcher said that, although 80 of the chain's approximately 2,000 shops were affected, most avoided a break in the cold chain because staff intervened quickly.

The incident therefore does not mean every affected supermarket has lost its refrigerated stock.

The effects extend beyond supermarkets: wholesale meat businesses and catering supplier Metro also reported problems, although the full extent of the damage remains unclear.

“The majority of the units affected are obsolete products (…) that have reached the end of their life cycle and no longer receive software or security updates,” Danfoss told Le Monde.

How were the freezers hacked? 

Cybercriminals managed to remotely take control of the thermostats and change the temperatures of the connected refrigerators and freezers. 

Cyber experts disagreed on the level of the sophistication of the attack. 

Antoine Hautin, Secretary General of Almond, a cybersecurity consulting firm, told AFP that changing hundreds of devices simultaneously showed a "certain level of sophistication." 

However, Clément 'SaxX' Domingo, an ethical hacker, told RMC that the attack was "not that sophisticated," adding that the hackers simply took advantage of "an update that wasn't done." 

Danfoss offered support for this claim, telling FranceInfo that it had "long recommended that its customers keep supported systems up to date with the latest firmware version and migrate outdated systems to next-generation solutions."