France Supermarket Cyberattack Raises Food Security Concerns

Μake us preferred on Google

Hackers took control of refrigeration systems at hundreds of French supermarkets overnight on October 11–12, forcing retailers to discard spoiled fresh and frozen food. French Finance Minister Roland Lescure told Parliament that about 700 stores were affected by the cyberattack, according to the Associated Press. Retailers hit included Intermarché, Netto, Coopérative U, Carrefour and Monoprix.

The attack came just five days before mass demonstrations over living costs and deteriorating public services escalated into rioting and looting in France on October 17.

France’s cybersecurity agency warned that the refrigeration attacks were potentially continuing and urged stores to update equipment, change passwords and secure remote connections. Intermarché reported losses running into tens of millions of euros, AP reported.

According to Reuters, compromised refrigeration systems used software from Danfoss and Copeland, including its Dixell brand. Danfoss said many affected units were obsolete or running outdated firmware. The precise method of intrusion had not been publicly established, and investigators have not identified a perpetrator. No public claim of responsibility has been made, nor has a ransom been demanded.

A separate cybersecurity incident disrupted supermarket group Ahold Delhaize during the same period. In its initial announcement, the company said it had detected a network security issue and taken some systems offline as a protective measure.

The disruption affected Albert Heijn in the Netherlands, Delhaize in Belgium and US chains including Stop & Shop, Giant Food, Hannaford and Food Lion. Reuters reported on October 19 that Dutch and US websites and delivery services remained disrupted, while Belgian deliveries had resumed. Physical stores stayed open, although distribution problems affected supplies. Ahold said it had no evidence that customer data had been stolen.

Despite the overlapping timing, the Dutch National Cyber Security Centre said there was no reason to believe the Ahold incident was linked to the French refrigeration attack, Reuters reported.

Earlier supermarket cyber incidents have involved the theft of personal and payment information. In July, Lidl warned customers in Germany, Belgium and the Netherlands that a breach at an external IT service provider had exposed information including names, email addresses, telephone numbers and dates of birth. According to TechRadar’s reporting on Lidl’s notification, passwords, payment details and billing and delivery addresses were unaffected. The attackers were not identified.

In February, cybersecurity firm Sansec reported finding payment-skimming code on an unnamed global supermarket chain’s online store. A fraudulent payment form captured customers’ card details before directing them to the legitimate checkout. Sansec did not identify the retailer or the attackers.

Ahold Delhaize itself suffered a separate attack in November 2024 that exposed personal, financial and health information belonging to more than 2.2 million people, BleepingComputer reported. That earlier attack was attributed to INC Ransom; the attribution does not extend to the company’s October 2026 incident.

The variety of cyberattacks on food chains over the past year are raising concern among governments, with Greece’s National Cybersecurity Authority reporting on October 14 that it had identified more than 300 internet-exposed systems in the country, primarily commercial refrigeration controllers, and urging operators to disconnect them from the public internet, secure remote access, change default passwords, install security updates and replace unsupported equipment.

cn