Cyberattacks on supermarket refrigeration systems have affected hundreds of stores in France and disrupted equipment at retailers in several other European countries, raising concerns about internet-connected controls used to monitor and maintain cooling units remotely.
In France, attackers took control of refrigeration systems overnight on October 11–12. The source reports that temperatures in some refrigerators and freezers reached 50°C, damaging food and causing fires at some stores. Retailers said at least 350 supermarkets were affected. TIME reported that Intermarché and Netto accounted for 180 stores, Coopérative U at least 100, and Carrefour 80. Intermarché CEO Thierry Cotillard told BFM-TV that losses across France ran to tens of millions of euros in a single day. The Paris prosecutor’s office opened an investigation, and Prime Minister Sébastien Lecornu asked France’s national cybersecurity agency to examine the incident.
On November 2, retailers in Sweden, Belgium, Luxembourg and Estonia reported further refrigeration problems that appeared to be linked to cyberattacks. Chains including Ahold Delhaize, Colruyt, ICA and Coop reported affected equipment. Carrefour Belgium said 15 of its more than 700 stores were affected, while Coop Sweden put its total at seven. Reports also pointed to incidents at stores in Ireland, the Netherlands and Finland, with later reports mentioning Germany, Portugal, Romania and Italy.
According to BFM-TV, the attackers forced refrigeration systems into repeated defrost cycles. Le Monde reported that defrost periods at some units were extended from one hour to eight, delaying alarms. In Belgium, the head of refrigeration installer Sabcobel said the units’ evaporators had been switched to defrost mode.
France’s cybersecurity agency, ANSSI, said the attack there affected Danfoss AK-SC and AK-SM refrigeration management systems. Danfoss said the affected units were running outdated firmware. A security study published by Claroty in August had identified flaws in a Danfoss controller that could allow an intruder to bypass login, according to TIME. Danfoss updated the system firmware, but Reuters reported that Danfoss units were also involved in the November incidents.
The systems are connected to allow remote monitoring and maintenance, often through central dashboards accessible over the internet. ANSSI has advised restricting remote access to trusted IP addresses. Patrick Lamplmair, technology director at cybersecurity company Tributech, told Gizmodo that thousands of the controllers remained accessible online after the French attack. He described how a small number of commands could be enough to empty a store’s stock, without stealing data or demanding a ransom.
There is no evidence in the available reporting that artificial intelligence was used in these attacks. Belgium’s Centre for Cybersecurity said it did not know who was responsible and that the identity of the attackers might never be established. Its spokesperson, Katrien Eggers, told Reuters she was concerned that AI could make it easier to exploit weaknesses in systems. The UK’s National Cyber Security Centre expects AI-powered malware to be used in a ransomware attack against the country’s critical infrastructure by 2028. Its director, Richard Horne, cited heating and cooling among the physical-process systems society relies on and said the French incidents showed how readily they could be exploited.
The exposure may extend beyond supermarkets. Forescout’s research division found 12,976 refrigeration services accessible from the internet across 6,017 public IP addresses in 99 countries. The company warned that similar risks could affect cooling equipment in hospitals and agricultural facilities, as well as pharmaceutical storage, food-processing plants and warehouses.
Sources: Xataka.