Netto

Summary

Netto locations were included among the approximately 180 Intermarché and Netto stores affected by an attack that manipulated refrigeration software and forced cold units to heat up.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

The cyberattack began overnight on Sunday into Monday, when hackers remotely manipulated refrigeration-control software supplied by Danish engineering firm Danfoss. The software was used to manage supermarket cold units, including their normal overnight defrost cycles. According to French broadcaster BFMTV, the attackers caused forced defrosting to run continuously and altered refrigeration temperatures remotely. Intermarché reported that some refrigeration units heated to 50°C for approximately six hours overnight, while an ice-cream freezer was reported displaying a temperature of 26.5°C. Managers arriving at stores on Monday morning encountered a wave of hot air from freezers, and small fires were reported in some locations.

The incident affected Netto and Intermarché stores operated by Mousquetaires Group, along with outlets belonging to other major French retailers. The BBC reported that 180 Intermarché and Netto stores had been affected and that another 100 shops were urgently disconnected from the internet to prevent the same attack. AFP described at least 300 Intermarché or Netto shops as targeted, while BFMTV-derived reporting placed the combined number of affected Intermarché, Netto and Coopérative U stores at around 400. Coopérative U confirmed that more than 100 of its supermarkets were affected. E.Leclerc also confirmed that a cyberattack against one of its refrigeration-equipment suppliers caused operational disruption in several stores.

Other retailers reported damage or disruption. Carrefour said refrigeration units in 80 of its 6,000 French stores were compromised. Monoprix reported that 5% of its more than 400 stores were affected and removed products from sale whenever their condition could not be guaranteed. BBC estimates based on figures supplied by individual chains indicated that approximately 400 of France’s roughly 15,000 supermarkets were affected. The published reports did not provide a separate confirmed count for Netto stores alone.

Danfoss said most affected equipment consisted of legacy refrigerator-regulator systems that no longer received software or security updates. The company identified the AK-SM800 and AK-SC355 systems among those affected, with one version of the AK-SM800 running outdated firmware. In August, security researcher Amir Zaltzman of Claroty had reported several vulnerabilities in Danfoss refrigeration controllers, including flaws in how the web server handled requests that could allow clients connected to a device to be manipulated. A patch for three Danfoss controllers had been available since September 18, but the reported incident involved systems described by Danfoss as no longer receiving updates. The published accounts did not establish whether those specific vulnerabilities enabled the attack.

Fresh and frozen food was exposed to unsafe temperatures and had to be discarded. Intermarché said it threw away all affected food to avoid health risks, while Netto and Intermarché stores removed products from refrigeration units as a precaution. Some fresh and frozen-food display units remained out of service on Monday afternoon. Staff worked with refrigeration specialists to restore systems and restock shelves, and crisis teams reportedly coordinated emergency supplies and technical assistance. Intermarché condemned the resulting food waste and financial losses without initially providing a total.

The financial consequences were already substantial, although the nationwide total remained unclear. Two supermarkets in Alsace reported combined losses of €270,000, and broader losses were expected to run into millions of euros. The disruption also temporarily affected the availability of refrigerated products at affected locations while stores removed compromised stock and restored refrigeration.

Paris prosecutors opened a specific cybercrime investigation into what they described as a large-scale attack affecting refrigeration systems at several major French food retailers. The investigation was intended to identify victims and establish links between the cyberattack, reported food losses and the fires that followed. France’s national cybersecurity agency, ANSSI, identified a vulnerability in software supplied by a Danish company and contacted the vendor. It also began liaising with European counterparts because other countries could be affected, seeking to identify additional French companies involved so they could be alerted and the spread of the incident prevented.

Sources

Sources available to members: 4 sources.