A large-scale cyberattack targeting refrigeration and freezer systems has struck hundreds of supermarkets across France. Hackers remotely manipulated the equipment to drive temperatures as high as 50 degrees Celsius, forcing stores to dump large volumes of food and triggering fires at some locations. With losses expected to reach tens of millions of euros and concerns mounting that similar attacks could occur elsewhere in Europe, the case has heightened alarm over cybersecurity in the food distribution chain.
The Paris prosecutor's office said major French food distributors were hit by a large-scale cyberattack, according to Reuters and other outlets on the 12th. The hackers appear to have seized control of software that regulates temperatures in refrigeration and freezer units, then heated the equipment abnormally overnight. At some stores, temperatures climbed to 50 degrees Celsius over six hours, requiring all stored food to be discarded.
French media have described the incident as an unprecedented cyberattack on the food distribution chain. Supermarket managers arriving at work that morning were met by hot air pouring out of freezers, and small fires broke out at some stores. French broadcaster BFM TV published a photograph showing a freezer display in an ice cream section reading 26.5 degrees Celsius.
The full extent of the damage has yet to be tallied. But data released by major French retailers suggests that more than 400 of roughly 15,000 stores were affected. Carrefour said 80 of its 6,000 stores were attacked, while Monoprix said about 5% of its stores suffered damage. Other large retailers including Intermarché and Netto also reported damage.
The economic toll is expected to be substantial. Two supermarkets in France's Alsace region alone sustained 270,000 euros in damage, according to the BBC. Thierry Cotillard, chief executive of Intermarché, estimated that losses would run into tens of millions of euros a day across France.
The case has drawn attention to structural vulnerabilities in the remote management systems used for refrigeration equipment. Supermarkets control the temperature of refrigerators and freezers through integrated control units, and maintenance contractors can also log in over the internet from outside to change settings. Remote control features designed to improve management efficiency can thus be exploited as an entry point for hackers. In this attack, a security vulnerability in software supplied by Danish company Danfoss appears to have compounded the problem.
The French government has launched an investigation and moved to prevent further damage. Prime Minister Sébastien Lecornu ordered the National Cybersecurity Agency (ANSSI) to investigate, and authorities are checking whether similar risks exist in equipment at other companies. Christophe Hansen, the European Union's commissioner for agriculture and food, condemned the attack, saying the weaponization of food had become a reality and that food security required greater attention at every level.
Separately, researchers have warned that artificial intelligence could take over poorly secured smart appliances without authorization and use them as launch points for cyberattacks. Anthropic researchers released findings the same day showing that AI can replicate and spread on its own across internet-connected devices such as refrigerators, televisions and robot vacuums. In such cases, they noted, the absence of a central control point to block the attack could make a response harder than with conventional cyberattacks.