Hundreds of French supermarkets have been hit by a cyberattack that caused their fridges and freezers to heat up, spoiling fresh and frozen food estimated to be worth millions of euros.
Hackers gained control of the software that regulates the temperatures of the refrigeration units, forcing some to warm to 50 °C (120°F) overnight, according to one affected supermarket chain.
The chief executive of Coopérative U said several of its supermarkets had been hit by the “extremely serious and unprecedented” attack.
More than 100 of the chain’s supermarkets were targeted, while 180 stores from Intermarché and its Netto brand were affected, with a spokesman saying that another 100 shops were urgently disconnected from the internet to prevent the same thing happening to them.
Other major food retailers, including Carrefour, Monoprix and E.Leclerc, were also hit by the attack, which targeted software provided by the Danish engineering firm Danfoss.
The software allows retailers to manage their cold units remotely.
Normally, supermarket freezers undergo a brief overnight defrosting period, during which temperatures rise slightly. But the hackers ordered the units to heat up and stay hot, although Danfoss did not confirm any reports on how warm the fridges and freezers could become in the process.
Danfoss said the affected cold units were older models whose security software could not be updated to ward off a risk they had identified.
The firm added in s statement that it had “long advised” businesses to keep supported systems up to date.
“Reliable refrigeration is critical to our customers’ operations, and we remain committed to supporting our customers and helping them maintain secure and reliable systems they are used to.”
The full scale of the attack is unclear, but figures supplied by individual chains suggest about 400 stores were affected out of 15,000 or so overall in France.
Carrefour said fridges in 80 of its 6,000 stores were hacked, while Monoprix said 5% of its 400-plus stores had been hit, with food removed from sale if its condition could not be guaranteed.
In a statement to the BBC, Mousquetaires Group – which owns Intermarché and Netto – said some fresh and frozen food display units remained out of service on Monday afternoon.
The stores had “taken all necessary precautions to remove the products from these units”, it said, adding that staff were working to restock the shelves “as soon as possible”.
Intermarché said its fridges had heated up to 50C for six hours overnight into Monday, and the retailer had thrown away all the affected food to avoid health risks, the Reuters news agency reported.
As a result of the attack, managers arriving at branches of several supermarket chains on Monday morning were hit by a wave of hot air from the freezers. In some places there were even small fires.
French broadcaster BFMTV published an image showing a freezer in an ice cream aisle displaying a temperature of 26.5C.
Two supermarkets in the Alsace region reported losses of €270,000 (£228,000) between them, the broadcaster added, meaning the nationwide total could run into the millions.
French prosecutors have opened a specific cybercrime investigation into the incident, which the Paris prosecutor’s office described as a “large-scale cyber-attack affecting the refrigerators of several major food retail chains across France”.
European Food Commissioner Christophe Hansen condemned the hack in a post on X and added: “Food security requires more attention at all levels. Because the weaponisation of food has become a reality.”
In a post on X, Coopérative chief executive Dominique Schelcher said staff were “fully mobilised, in co-ordination with refrigeration specialists, to restore the situation as quickly as possible”.
He called for an investigation into the hack and said targeting equipment essential to the French food supply was “unacceptable”.