Carrefour

Summary

Carrefour said 80 supermarkets were hit in the overnight attack, which remotely altered refrigeration temperatures and destroyed stocks; most of its 6,000 stores were unaffected. No threat actor was named.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

A large-scale cyberattack occurred overnight from Sunday, October 11, into Monday, October 12, affecting Internet-connected refrigeration equipment at several major food retailers across France. The Paris prosecutor’s office said the attack targeted connected refrigerators and freezers operated by multiple grocery chains. According to subsequent reporting, attackers remotely altered refrigeration controls and triggered forced-defrosting functions, causing temperatures in many affected units to rise as high as 50 degrees Celsius, or 122 degrees Fahrenheit. The operation exposed fresh and frozen merchandise to damaging temperatures and affected refrigeration systems essential to preserving products at the affected locations.

Carrefour disclosed on Monday that 80 of its supermarkets had been affected. The company said the vast majority of its approximately 6,000 French stores had not been hit. The attack also affected other retailers, with Monoprix reporting around 30 affected locations, Intermarché reporting 150 to 200, and Coopérative U reporting almost 100. Intermarché said the affected branches would have to discard their fresh and frozen products. The precise total number of sites included in the broader attack was not consistently reported, although the incident affected several hundred supermarkets across the country.

The physical consequences included spoiled food and fires at several hundred stores. Temperatures were altered remotely, resulting in the destruction of stocks of fresh and frozen products, while some refrigeration equipment caught fire as it overheated. The reports did not provide a Carrefour-specific total for discarded merchandise, fires, financial losses, or operational interruptions at its 80 affected supermarkets. Intermarché did not quantify its losses and warned that its insurance policies might not cover this type of in-store incident.

The Paris prosecutor’s office opened an investigation into the attack. Its stated objectives were to identify the victims and establish the connection between the cyberattack and the reported food losses and outbreaks of fires. The probe followed confirmation from multiple retailers that their refrigeration systems had been remotely compromised. Coopérative U chief executive Dominique Schelcher described the targeting of equipment used to preserve fresh products and support the food supply as “unprecedented” and “extremely serious.”

A later examination of the affected equipment focused on vulnerabilities in the firmware of the Internet-connected cooling systems, which allowed outside actors to access and manipulate the refrigeration units. Danfoss, which supplied the connected cooling systems, said many of the affected units were at the end of their service life or were running outdated firmware. The company also said affected grocers had previously been warned to migrate away from outdated systems and update them. By October 16, the investigation into the scope of the attack, the affected retailers and locations, and the link between the intrusion and the resulting fires and food losses remained underway.

Sources

Sources available to members: 2 sources.