Intermarché

Summary

Hackers compromised the refrigeration control systems of numerous French supermarkets, raising fridge temperatures to around 50 °C for several hours and triggering food spoilage and isolated fires. Intermarché reported that about one hundred fifty of its stores were affected, leading the retailer to discard all perishable goods as a precaution. Coopérative U confirmed similar impacts on its outlets, while other chains such as Carrefour, Monoprix, Auchan and E Leclerc were reported to be under investigation for possible compromise. The French national cybersecurity agency traced the breach to a vulnerability in refrigeration management software supplied by Danfoss, noting that the affected units were running outdated firmware and urging customers to update to supported versions. The incident prompted coordination with European partners to assess any cross‑border effects, including reported security issues at Ahold Delhaize stores in the Netherlands and Belgium.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On the night of the attack, hackers gained remote access to the refrigeration control systems of hundreds of French supermarkets and raised the temperature inside the units to as high as 50 °C. The temperature increase persisted for several hours in many locations, causing the refrigeration equipment to effectively defrost and overheat. As a result, stores reported spoilage of perishable goods and, in some cases, fires that damaged the affected units. The Paris prosecutor’s office confirmed that the incident constituted a large‑scale cyber‑attack targeting connected refrigerators in several major food retailers across the country. The office noted that the damage included both food losses and fires, prompting immediate concern for public health and safety. In response, Prime Minister Sébastien Lecornu directed France’s national cybersecurity agency ANSSI to open an investigation into the breach.

Les Mousquetaires, the parent company of Intermarché, reported that roughly 150 of its stores were hit, with the refrigeration systems heated to 50 °C for about six hours before the issue was detected, leading the retailer to discard all food in the affected units to avoid any health risk. Dominique Schelcher, chief executive of Coopérative U, confirmed that his chain’s supermarkets were also affected and described the targeting of essential preservation equipment as unprecedented and extremely grave. While Carrefour, Monoprix and Auchan were approached for comment, they did not respond to requests for information. According to BFM TV, France’s largest supermarket chain E Leclerc experienced a similar remote triggering of forced defrosting in numerous stores, although the company likewise declined to comment. The attack’s possible reach beyond France was noted when the Dutch retailer Ahold Delhaize disclosed that it was dealing with a security issue in its network and had taken several systems offline as a protective measure. Stores of its Albert Heijn chain, which operates in the Netherlands and Belgium, remained open but experienced disruptions to its online app and delivery service, and electronic price tags frequently displayed incorrect information. Belgian media also reported that Delhaize supermarkets, which operate in Belgium and Luxembourg as part of Ahold Delhaize, were affected by the same security issue, though a direct link to the French incident remained unclear.

ANSSI’s investigation, as conveyed by a source close to the prime minister’s office, identified a vulnerability in refrigeration management software supplied by the Danish company Danfoss as a contributing factor. Danfoss acknowledged awareness of incidents in France affecting a limited number of its refrigeration management systems and stated that the affected units were running outdated firmware. The company emphasized that it had long advised customers to keep supported systems updated with the latest firmware and to migrate legacy systems to current‑generation solutions. The incident occurred amid broader European concerns about the potential damage that cyber‑attacks could inflict across critical sectors. In the preceding month, French President Emmanuel Macron had ordered measures to strengthen the protection of France’s critical infrastructure against Russian hybrid attacks, a context that framed the response to the supermarket breach.

Sources

Sources available to members: 2 sources.