Shortly before midnight last Sunday, the digital thermostats controlling hundreds of supermarket cold aisles across France began to flicker and rise.
In a “bizarre and unprecedented” cyber-attack, hackers had remotely overridden the temperature settings on thousands of freezers, fridges and chiller cabinets pushing them from as low as -۲۷C (-۱۶.۶F) to well over ۵۰C (۱۲۲F).
Over the next four to six hours, the food inside first defrosted, then slowly began to cook.
Shop staff arriving early to restock shelves reported catching a blast of hot air, like opening an oven, when they went to fill freezers. One Normandy supermarket reported a number of its freezers had been pushed to ۸۰C (۱۷۶F). In certain stores, the extreme temperature rise had sparked fires triggering sprinklers and water damage.
“It was a catastrophe,” said one worker at the large Intermarché supermarket in the south-west suburb of Issy-les-Moulineaux in Paris. “They pushed the freezers here up to ۶۲C. Everything had to be thrown away. It was such a waste.”
After removing tons of spoiled food, staff at the store worked until almost midnight on Monday to reorder and restock shelves. “Thankfully, we were able to get things almost back to normal the same day,” another shop worker added. “But we had to clear out everything in the freezers.”
If shop managers first assumed it was an isolated failure, it soon became clear up to ۷۰۰ stores – including those from the Intermarché, Coopérative U, Carrefour, Leclerc and Monoprix chains along with a number of smaller independent shops – had been victims of a cyber-attack.
Dominique Schelcher, the president of Coopérative U, said ۸۰ of its ۲,۰۰۰ supermarkets had been targeted. “This is a completely unprecedented, unexpected, and extremely serious attack. In my entire professional career, I’ve never seen anything like it,” the shocked executive told French radio.
The Paris public prosecutor’s office immediately opened an investigation into the latest in a series of cyber-attacks that have made France the most hacked country in Europe.
Gérôme Billois, a partner in the cybersecurity and technology company Wavestone, said the hack had the hallmarks of political sabotage.
“The two most feasible scenarios are either it was a group of youngsters or activists who wanted to blow up a few freezers to prove what they could do, or it was a destabilising attack, what we call sabotage, by internal or external state actors,” he said.
“As for the attack’s signature, the most likely scenario is still a destabilisation attack – one designed to convey the message to populations that they are not safe, to convey the impression that the government is falling apart, and ultimately to instil fear.
“Currently there are two international actors known for doing this sort of thing: Iran and Russia.”
The hackers had pirated the controllers supplied by the Danish company Danfoss that controls the freezers and fridges. Most supermarket cold aisles are connected to the internet to allow remote maintenance and alerts for system failures. Initial investigations suggest the hackers disabled alarm systems before tampering with the thermostats, or extended the defrost programme by several hours to avoid triggering alarms.
Danfoss said it had identified security flaws last year and had “long recommended” that customers install updates or replace obsolete unsupported systems. The affected refrigeration units were “running outdated firmware”, it said. In the days following the first wave of attacks, France’s cyber-attack alert centre ANSSI confirmed supermarkets using controllers from two other companies were also targeted.
Marta Rybczyńska, a cybersecurity specialist and researcher, said she had found previous security warnings about old supermarket freezers running out-of-date software and newer models not having firmware updated.
“Some of these freezers hadn’t been supported by the manufacturers for several years and there were notices saying they should be replaced. Other freezers were newer but the software hadn’t been updated,” Rybczyńska said.
“The hackers found these weaknesses and used them.”
She added: “Many of the freezers appear to have been running with a default password. The hackers were able to modify or turn off the alerts so the shops only realised when the first person arrived in the morning and saw the damage that had been done.”
The most recent French cyber-attack mirrors a similar incident in the US in August when connected fridges and freezers at a dozen military commissaries – on-base food stores – went into unscheduled defrost cycles overnight causing massive food loss.
France is the most heavily pirated country in Europe by the volume of records exposed by hackers, according to the cybersecurity and risk management company Upguard.
In the last three years, hackers have breached France’s health system, France Travail, the government-run jobseekers agency, the National Agency for Identity Documents (ANTS) and most of the big mobile phone companies. This summer, the economy and finance ministry lost the personal and fiscal records of ۶۷۸,۰۰۰ taxpayers to a series of cyber-attacks.
Billois says France has fallen behind in addressing cybersecurity and has still not adopted the EU’s Cyber Resilience Act (۲۰۲۴) that introduced mandatory security for internet-connected devices.
“It’s a text that’s not political and that everyone agrees on but is delayed because there’s always more urgent legislation or there are quibbles about amendments, and this has been a disaster,” he said.
In the UK, the cyber security and resilience (network and information systems) bill to tackle cyber threats, is wending a similarly tortuous way through parliament. However, it fails to directly cover the food industry.
Supermarket boss Schelcher was quick to shift the blame for the attack on to unnamed refrigeration contractors who maintain the cold aisle equipment. “Our supermarkets are not customers of Danfoss,” he told RTL radio.
As yet, no individual or group has claimed responsibility for the supermarket cyber-attack; Paris prosecutors have instructed detectives from its anti-cybercrime unit but Billois says finding the hackers will take time.
“It’s possible they’ll be identified eventually, but it could take weeks if not months to be certain because hackers know how to hide their tracks,” Billois said.
Rybczyńska added: “Whether it’s possible to trace the hackers depends on their level of capability; if it’s a handful of youngsters, it’s easier because they probably won’t have thought to remove traces. If they are professionals it’s more complicated and will take longer. If they’re in a foreign country, it’ll be extremely difficult.”
The total cost of the cyber-attack has yet to be calculated but Thierry Cotillard, the CEO of Intermarché, said losses could run to “tens of millions of euros”, which store companies say is unlikely to be covered by their insurance.
“It’s a bizarre story,” Billois added. “There’s a shared responsibility between the supermarkets, the refrigeration companies who are sub-contractors and who maintain the material, and the software company. We cannot say who is to blame except, of course, the hackers.
“But in the end it comes down to freezers connected to the internet without being adequately secured. And that must be a wake-up call to everyone.”
