The French supermarket cyberattack affected about 700 of the country’s 10,000 supermarkets, Finance Minister Roland Lescure told Parliament on Tuesday, October 13. He said there is no risk to France’s food supply, but called the attack a hit on the heart of the country’s food security and a wake-up call for everyone.
Hackers struck overnight between Sunday, October 11, and Monday, October 12, according to the Associated Press. They remotely connected to store refrigeration equipment and forced defrost cycles. French broadcaster BFMTV reported that temperatures rose as high as 50°C (122°F). Staff arrived Monday to spoiled food and puddles under freezers, and several stores had fires.
What we know about the French supermarket cyberattack
Several of France’s biggest grocery groups confirmed they were hit:
- Les Mousquetaires, which owns Intermarché and Netto, said 300 of its stores were affected. Reuters reported that fridges at the affected Intermarché stores were heated to 50°C for about six hours, which forced the company to throw out food to avoid health risks.
- At least 100 Coopérative U stores were hit.
- Carrefour said 80 of its supermarkets were affected, out of about 6,000 stores.
- Monoprix said about 5% of its roughly 490 stores were hit.
- E.Leclerc said several of its stores were affected.
Independent grocers and butchers using the same refrigeration system may also have been affected. Two supermarkets in Alsace reported losses of 270,000 euros, according to BFMTV. No total figure for the damage has been published.
How the attack happened
France’s cybersecurity agency, ANSSI, said it is aware of numerous compromises of remote-control modules for refrigeration systems made by Danish company Danfoss and U.S.-based Copeland. Danfoss said most of the affected systems are older products that no longer receive software or security updates. It said it has long advised customers to keep supported systems updated and to run them behind a firewall. Earlier, Danfoss had described the incidents as limited and said some affected stores were already operating again.
CNN reported that more than 1,700 installations of the affected Danfoss software were exposed to the internet in France before the attack, which gave hackers a wide range of targets. Security firm Claroty reported vulnerabilities in a Danfoss controller and a Copeland controller earlier this year. Reporting so far does not confirm that those flaws were used in this attack.
Reaction from officials and retailers
Dominique Schelcher, the chief executive of Coopérative U, called the attack unprecedented and said targeting equipment that keeps fresh food safe is an attack on the French food supply chain. The European Union’s agriculture commissioner said the weaponization of food has become a reality, according to Semafor. A cybersecurity consultant told AFP that the scale of the attack suggested a certain level of sophistication.
Who is investigating
No group or person has claimed responsibility. The Paris prosecutor’s office has taken the case under its national jurisdiction and described the French supermarket cyberattack as large-scale. Prime Minister Sébastien Lecornu asked ANSSI to investigate. His office said France is working with European partners to check whether other countries or French companies could be affected, since stores elsewhere may use the same software.
A separate incident at Ahold Delhaize
At the same time, Ahold Delhaize, the parent company of Albert Heijn, Delhaize, Food Lion, Stop & Shop, Hannaford and Giant Food, said it took systems offline after a cybersecurity incident on Sunday. Websites, apps and online delivery were suspended in the Netherlands, Belgium and the United States, though its stores stayed open. Reports in the Netherlands said some Albert Heijn distribution centers had stopped work. No link between this incident and the French supermarket cyberattack has been confirmed.
What happens next
The main open questions are who carried out the attack, how the attackers got into the systems, and whether the same equipment is exposed in other countries. ANSSI and the Paris prosecutor’s office are working on all three. Shoppers should follow instructions from their retailer or French health authorities, as no official consumer food-safety guidance has been published in the reporting reviewed.