What happened

Attackers took remote control of refrigeration systems in hundreds of French supermarkets and independent stores in the early hours of Monday, 12 October. Temperatures reached 50 degrees Celsius for about six hours, and stores threw away fresh and frozen food. Intermarché reported losses of tens of millions of euros in a single day. One report put the number of affected Intermarché stores at about 150, while the Groupement Mousquetaires group said 300 of its Intermarché and Netto stores were hit, and the two figures have not been reconciled. Carrefour reported 80 affected supermarkets, and Cooperative U said 80 of its 2,000 stores were hit. Fires broke out in some stores, and two shops in Haguenau, Alsace, reported losses of about 270,000 euros.

Official response

France's cybersecurity agency said late on Tuesday, 13 October, that the attacks were "likely still underway". It advised stores to reconnect refrigerators to the internet only through a secure VPN or protected network, to install firmware updates and to change passwords. Finance minister Roland Lescure told parliament on Tuesday that about 700 of the country's 10,000 supermarkets were affected, and he said the attack posed no risk to food supply in France. Prime minister Sébastien Lecornu asked the agency to investigate. Paris prosecutors said their cybercrime unit is examining the damage from spoiled food and reported fires, and Europol said it is in contact with the affected countries but declined to give details.

The Dutch chain

Ahold Delhaize, the parent company of the Dutch supermarket group, shut some systems as a precaution and called the event a "cybersecurity incident". The shutdown halted home deliveries and disrupted some supplies, and on Tuesday its websites for Albert Heijn, Delhaize, Stop & Shop, Food Lion and Giant remained offline while its stores stayed open. The company said it had no evidence that customer or employee data had been stolen. On Wednesday, 14 October, it was restarting the systems it had shut down. The Dutch National Cybersecurity Center saw several incidents across Europe's food sector but "no reason at this time" to link them.

How the systems were exposed

Claroty, an Israeli-American security firm, reported in August that 2,765 Danfoss AK-SM 800A controller interfaces were reachable from the internet, and Danfoss had already released fixes. The Danish manufacturer said the compromised equipment was either outdated or had not been updated. Claroty told La Tribune that its researchers reproduced the attack in a lab in 28 minutes, using Anthropic's Claude on a Danfoss product. Spanish security expert Iván Pérez, speaking to AS, said some systems appeared to use the login "admin" with the day's date as the password, although it is not confirmed that the attackers used that route. The CERT-FR bulletin lists Danfoss AK-SM and AK-SC controllers and Copeland xweb and Dixell xweb systems among those compromised.

Who may be behind it

François Deruty, a former operations director at the French Cybersecurity Agency, told AP that those responsible could range from state-sponsored actors to a disgruntled French student. No perpetrators have been publicly identified and no one has claimed responsibility. Marco Fanuli, technical director of TrendAI, a Trend Micro division, told Adnkronos that the growing number of connected equipment widens the attack surface.

“More and more devices, plants and machines are being connected for efficiency, monitoring and remote maintenance.”

Fanuli added that such systems are often run by third-party suppliers and were designed when security was not a priority, which makes an interruption with immediate impact attractive to attackers. Many of the internet addresses used to reach these control systems remain accessible.