French authorities are investigating a cyberattack that disrupted refrigeration systems in at least 350 supermarkets, forcing staff to discard spoiled meat and frozen goods. The affected stores, including outlets of Carrefour, Monoprix, Intermarché, and Coopérative U, represent a small fraction of the country's retail network, but the incident has raised alarms about the security of critical infrastructure.
The attackers manually overrode temperature controls, causing food to thaw and spoil. According to a source familiar with the probe cited by Reuters, the lack of a ransom demand or any claim of responsibility has puzzled investigators. Criminal groups and hacktivists typically seek to profit from or publicize their actions, making this silence unusual.
Vulnerable devices remain online
France's cybersecurity agency said the breach affected refrigeration units running software from Danish firm Danfoss, as well as systems from Copeland and Dixell. A scan by Reuters found at least 4,500 Danfoss interfaces still visible online on Tuesday, and the scanning firm Onyphe noted that outdated versions remain "still widely represented among publicly accessible interfaces."
Danfoss acknowledged that many affected units have "reached end of life and no longer receive software or security updates," or were "running outdated firmware." Serious flaws in older firmware versions were detailed in August by security firm Claroty and have since been patched. Copeland, which owns Dixell, acknowledged the "vulnerability" and said it is "currently working with impacted customers to mitigate the risk."
Ken Munro, a partner at British firm Pen Test Partners, told Reuters that the incident boils down to "basic cyber hygiene." He warned, "Get it wrong and you get a smelly mess of defrosted food." Munro speculated that the attack could be the work of "kids messing around," noting that if a nation state were behind it, they would likely target a broader range of countries, not just a subset of French fridges.
Dutch disruption and supply chain fragility
In the Netherlands, Ahold Delhaize, the parent company of supermarket chain Albert Heijn, said it had begun a controlled restart of systems after a cybersecurity incident that began on Sunday. The Dutch cybersecurity watchdog NCSC said it saw no link to the French attack. Dutch broadcaster NOS reported that Albert Heijn had identified servers in the US, Poland, Moldova, and Turkey used in the attack, though NOS stressed that this reveals nothing about the hackers' location, as traffic can be easily routed through other countries.
Security specialist Pim Takkenberg told NOS that the servers were likely used to scout the systems or attempt to steal data. The incident also exposed how thin food stocks are: shops and distribution centres hold around six days' supply between them, replenished continuously by just-in-time IT systems that can fail and depend on the power grid.
A report by Clingendael and Erasmus University last month advised households to keep eight days of emergency food rather than three. It found that severe weather combined with a major power and IT outage could take two weeks to recover from. The French supermarket cyberattack underscores the vulnerability of Europe's food supply chains to digital threats, a concern echoed by NATO's warnings about hybrid attacks across the continent.
As investigators in Paris and The Hague work to trace the perpetrators, the episode serves as a stark reminder that the internet of things extends to the most mundane of devices—and that a single flaw can lead to a smelly mess of defrosted food.
