Cyberattack on Danfoss software overheats fridges and freezers in hundreds of French supermarkets

Hundreds of French supermarkets were hit by a cyberattack that caused their fridges and freezers to heat up, spoiling fresh and frozen food estimated to be worth millions of euros, the BBC reports. The attackers took control of the software that regulates the temperature of the refrigeration units, and according to one of the affected chains, they even forced some to reach 50 °C overnight.

The attack targeted software from Danish engineering company Danfoss, which lets retailers manage their refrigeration equipment remotely. Freezers normally go through a brief overnight defrost cycle during which the temperature rises slightly, but the attackers ordered the units to heat up and stay hot. Danfoss did not confirm how hot the equipment actually got.

Danfoss explained that the affected units were older models whose security software could not be updated to protect against a risk the company had already identified. It added that it had long been advising businesses to keep supported systems up to date.

The exact scale is unclear. Based on figures from each chain, around 400 stores were affected out of roughly 15,000 in France. Coopérative U said more than 100 of its supermarkets were attacked, and its CEO, Dominique Schelcher, called the attack "extremely serious and unprecedented." Intermarché and its Netto brand had 180 stores affected, and another 100 were urgently disconnected from the internet to prevent the same thing happening to them. Carrefour said fridges at 80 of its 6,000 stores were affected, and Monoprix said 5% of its more than 400 stores had been hit, pulling from sale any food whose condition could not be guaranteed. E.Leclerc is also among the affected chains.

Intermarché said its fridges reached 50 °C for six hours during the night from Sunday to Monday, and that it discarded all affected food to avoid health risks, according to Reuters. Groupement Les Mousquetaires, which owns Intermarché and Netto, confirmed that on Monday afternoon some fresh and frozen product units were still out of service and that staff were working to restock shelves as quickly as possible. On Monday morning, managers at several stores were met with a blast of hot air when they opened the freezers and, in some places, even small fires. Broadcaster BFMTV aired an image of an ice cream freezer reading 26.5 °C. Two supermarkets in Alsace reported combined losses of €270,000, meaning the national total could run into the millions.

The Paris prosecutor's office opened a dedicated cybercrime investigation, describing a "large-scale cyberattack affecting the refrigerators of several major food retail chains in France." European Commissioner for Agriculture and Food Christophe Hansen condemned the attack, saying that "food security requires more attention at all levels" because "the weaponization of food has become a reality." Schelcher called for an investigation and said that attacking equipment essential to France's food supply is "unacceptable."

Note: the BBC article does not attribute the attack to any specific group or detail the method used, and the AI link suggested by the digest's original headline does not appear in the downloaded text.