Spar

Summary

Cyberattacks disrupted European supermarket chains, compromising refrigeration systems at hundreds of stores across France and forcing a major grocer to take its European and U.S. websites offline. Roughly 700 French supermarkets were affected, with attackers manipulating refrigeration controls to trigger continuous defrost cycles and raise temperatures to as high as 50 degrees Celsius, leading to spoiled food and reported fires. Additional chains including Intermarché, Netto, Cooperative U, Carrefour, and Monoprix reported impacts, while investigators examined compromised remote-control modules from Danfoss and Copeland that had been exposed to the public internet. Authorities noted no evidence of customer data theft but described the targeting of food-supply infrastructure as unprecedented and serious.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Cyberattacks disrupted European supermarket chains, affecting refrigeration systems at hundreds of stores in France and forcing a major grocer to shut down websites serving customers in Europe and the United States. French Finance Minister Roland Lescure told Parliament on Tuesday that about 700 of the country’s 10,000 supermarkets were affected. He said there was no risk to France’s food supplies but acknowledged that the attack touched the heart of the nation’s food security. He described the incident as a wake-up call for everyone. Separately, Dutch supermarket giant Ahold Delhaize said Tuesday it was working to restore systems it had shut down following what it described as a security issue. The company said its stores, including Albert Heijn in the Netherlands, Delhaize in Belgium, and Stop & Shop, Food Lion, and Giant in the United States, remained open, but the websites for those brands remained offline Tuesday. Ahold Delhaize said it had no evidence that customer or employee data had been stolen. The Paris prosecutor’s office said Tuesday that its cybercrime unit was investigating the large-scale attack in France, including the extent of damage caused by spoiled food and reported fires. According to BFM-TV, hackers forced a continuous defrost cycle and set temperatures as high as 50 degrees Celsius, or 122 degrees Fahrenheit, on stores’ refrigeration systems.

French supermarket group Groupement Mousquetaires, which operates more than 4,000 stores across Europe, said 300 of its Intermarché and Netto stores were impacted. Some refrigerated and frozen food display cases remained out of service Tuesday. Dominique Schelcher, CEO of French grocery chain Cooperative U, said 80 of the company’s 2,000 stores were affected. Most managed to prevent disruptions to refrigeration, but some had to discard food, he said in a post on X. Schelcher described targeting equipment essential to the French food supply chain as unprecedented, extremely serious, and unacceptable. Carrefour and Monoprix supermarkets were also impacted. The French government’s cybersecurity agency said Tuesday it was aware of numerous compromises involving refrigeration system remote control modules made by Danish company Danfoss as well as U.S.-based Copeland. Danfoss said Monday that most affected systems were older products that no longer received software or security updates, and that it was working with affected customers to limit the damage. The company said it had long advised customers to keep supported systems updated with the latest firmware and to operate behind a firewall. In an August report, U.S. cybersecurity firm Claroty identified vulnerabilities in the Danfoss AK-SM 800A and Copeland XWeb Pro platforms, which are used to manage refrigeration infrastructure in supermarkets, warehouses, and other facilities. Claroty said numerous controllers using the Danfoss system were directly accessible from the public internet, leaving them wide open for cyberattacks, but noted that Danfoss and Copeland had since fixed the vulnerabilities. Copeland said Tuesday that a vulnerability had been identified in a discontinued, end-of-life generation of controllers, and that it was working with impacted customers. The Paris prosecutor’s office continued to investigate the scale of the attack, and officials noted there appeared to be no ransom demand or stealing of information.

Sources

Sources available to members: 1 source.