A cyberattack on refrigeration systems hit several French large-scale retail chains on the night of October 11-12, causing temperatures to rise in their refrigeration systems and the subsequent destruction of large quantities of fresh and frozen products. The attack affected retailers such as Intermarché, Carrefour, Monoprix, E.Leclerc, and Coopérative U, including Hyper U, Super U, U Express, and Utile stores, with overall economic damage estimated at hundreds of thousands of euros.
Among the most affected companies was Intermarché, part of the Les Mousquetaires group, which confirmed the involvement of approximately 150 supermarkets. According to initial reports, hackers remotely accessed Danfoss refrigeration systems, manipulating the controls to raise temperatures to 50 degrees Celsius. This compromised food preservation, necessitating the removal of numerous products and causing significant repercussions on store management.
The attack brings the cybersecurity of food distribution infrastructure, which is increasingly dependent on digital systems for cold chain control, back into the spotlight. These risks were the focus of a study published in August by Team82, the research group at the cybersecurity firm Claroty, which identified vulnerabilities in Danfoss devices used to manage refrigeration systems.
The investigation identified 2.765 devices potentially accessible via the internet, highlighting vulnerabilities that could have allowed unauthorized access and system manipulation. The Danish manufacturer had already made security updates available, but it is unknown how many systems had actually installed them. Furthermore, the methods used by the perpetrators of the attack in France have not yet been clarified, and there is no confirmation of a direct link to the previously identified vulnerabilities.
"Devices that control refrigeration systems are a prime target for those who want to disrupt critical operations, but they often escape the attention of security teams," observes Amir Preminger, CTO of Claroty, emphasizing how the consequences can extend from supermarkets and food warehouses to pharmaceutical and chemical companies.
According to Preminger, the problem lies primarily in the belief that industrial systems are isolated from external networks and therefore protected from potential intrusions. "Our research, however, found that many of these devices are directly exposed to the internet. While this configuration significantly reduces maintenance costs by allowing technicians to diagnose and resolve issues remotely, it also facilitates access for cybercriminals."
This risk could further increase with the spread of artificial intelligence, which can reduce the time required to identify vulnerabilities and exposed systems. For food companies, cybersecurity therefore becomes essential for protecting goods, ensuring supply continuity, and preventing waste.
"Organizations must therefore take preventive action to prevent management interfaces from being exposed to the internet without adequate protection," Preminger concludes, recommending the use of trusted networks, VPNs, and appropriate access separation systems. The French attack demonstrates how a cyber breach can quickly translate into significant financial losses, jeopardizing not only technological systems but also the preservation and availability of food products.
