Coordinated Cyberattack Disrupts Supermarket Operations Across France
In a significant display of cyber sabotage, a coordinated attack targeting the operational technology (OT) behind refrigeration systems affected hundreds of supermarkets in France. This incident is being highlighted by security experts as one of the clearest examples of how cyber threats can translate into tangible physical consequences.
On October 12, retailers confirmed the disruption, which began the previous evening. The impact was widespread, with brands such as Intermarché, Netto, Coopérative U, and Carrefour reporting serious repercussions. At least 300 Intermarché stores and more than 100 Coopérative U locations were affected, alongside 80 Carrefour stores. Other retailers, including Monoprix, E.Leclerc, and Auchan, also reported operational challenges. Notably, BFM TV reported that cyber attackers remotely forced supermarket refrigeration units into continuous defrost cycles, raising internal temperatures to alarming levels of 50°C, which consequently led to fires and food spoilage.
Oded Vanunu, Head of Vulnerability Research at Check Point, commented on this alarming trend, emphasizing that supermarket refrigeration units have evolved far beyond mere electrical appliances. "These systems now constitute intricate computerized systems connected to broader networks, enabling remote monitoring and control," he explained. While this connectivity offers operational efficiencies, it also creates significant cybersecurity vulnerabilities. Many of these systems run on outdated software, often lacking regular security updates, and some management interfaces are accessible via the Internet.
Investigations revealed that the vulnerable equipment originated from the Danish manufacturer, Danfoss. A source close to Prime Minister Sébastien Lecornu indicated that France’s National Cybersecurity Agency (ANSSI) recognized a flaw in Danfoss’ software, prompting an in-depth investigation. Danfoss admitted that most of the compromised units were "legacy" products, specifically singling out the AK-SM800 and AK-SC355 controllers, which are no longer supported by software or security updates. The company noted that an affected version of the AK-SM800 was running outdated firmware, and they had advised customers for years to upgrade or replace these models.
According to reports, known vulnerabilities associated with the control software date back to 2023, with some classified as critical and patches available. August research from the OT security firm Claroty detailed flaws in Danfoss systems that could permit attackers to bypass authentication protocols. Analysts surmise that the perpetrators utilized the Shodan search engine to identify exposed devices, many of which were integrated through 3G cards for remote management.
Vanunu pointed out the concerning nature of this incident, stating that attackers did not necessarily need advanced capabilities to exploit the situation. "Refrigeration systems have legitimate operational functions, like defrost cycles. When unauthorized individuals gain access, these same functions can be manipulated to disrupt operations," he stated. Unlike typical data breaches, which often involve data theft or file encryption, this incident focused on disrupting the physical operations of refrigeration systems. The immediate consequences include substantial food inventory losses and potential safety hazards.
So far, no group has claimed responsibility for the attack, and there have been no ransom demands or indications of data theft. The Paris prosecutor’s cybercrime unit has launched an investigation into what they classified as a "large-scale" assault, while ANSSI is coordinating efforts with European counterparts to address the issue. Analyst Felix Aime from Sekoia mentioned that stores in Spain, Portugal, Poland, Germany, and Belgium have also felt the effects of this cyber onslaught.
Market analysts stress that the attack signals a new frontier for sabotage, specifically targeting operational technology in supermarkets—systems commonly cited by security organizations as vulnerable to such threats. "These systems include not just refrigeration but also building management controls and cold chain infrastructure," explained Muhammad Yahya Patel, a cybersecurity advisor.
The implications of this attack extend beyond immediate disruptions. Thierry Cotillard, CEO of Intermarché, estimated potential losses could reach tens of millions of euros within a single day. Coopérative U’s Dominique Schelcher indicated that larger stores might face losses between €180,000 and €200,000 in inventory. France’s retail federation, FCD, has called for Danfoss to assure full transparency regarding the vulnerable equipment.
The consequences for the food retail sector are dire and complex. Security professionals highlight the need for immediate attention to such vulnerabilities, as operational disruptions can escalate quickly. "Staff cannot trade normally without functioning refrigeration, and restocking becomes impossible until systems are restored and verified safe," Patel cautioned.
Experts recommend that organizations prioritize identifying OT assets exposed to the Internet and understanding who has remote access to these systems. Vanunu notes, "To mitigate these risks, the first step involves identifying which controllers and management interfaces are vulnerable and eliminating unnecessary exposure." Other recommended measures include keeping systems updated, restricting remote access, and enabling multi-factor authentication.
Ultimately, the French supermarket cyberattack serves as a cautionary tale about the evolving landscape of cyber threats. It underscores the urgent need for businesses to not only protect data but also safeguard their physical operations. Security leaders are encouraged to engage with boards to assess vulnerabilities proactively and ensure that plans are in place to mitigate potential risks.
As this event unfolds, it is clear that the connected nature of modern operational technology makes it imperative for organizations to reevaluate their cybersecurity strategies and defenses to protect against future incidents of this nature.