French Supermarkets Hit by Cyberattack as Dutch Grocer Faces Separate Disruption
French investigators are hunting for unidentified hackers who compromised refrigeration units at more than 350 supermarkets across the country over the weekend. The breach forced staff to discard spoiled meat and frozen goods after attackers manually manipulated temperature controls. Stores belonging to major chains including Carrefour, Monoprix, Intermarché, and Coopérative U were among those affected. This represents only a small fraction of France’s retail network. No group has claimed responsibility for the attack, which puzzles officials because criminal or hacktivist groups typically move quickly to profit from or publicize such incidents, according to a source with knowledge of the probe cited by Reuters.
France’s cybersecurity agency confirmed that the breach impacted fridges running software from Danish firm Danfoss, as well as Copeland and Dixell systems. Reuters reported finding at least 4,500 Danfoss interfaces visible online on Tuesday. Scanning firm Onyphe stated that outdated versions remain widely represented among publicly accessible interfaces. Danfoss said many affected units had reached end of life and no longer receive software or security updates, or were running outdated firmware. Security firm Claroty detailed serious flaws in older firmware versions in August, which have since been patched. Copeland, which owns Dixell, acknowledged the vulnerability and stated it is working with impacted customers to mitigate the risk.
Ken Munro, a partner at British firm Pen Test Partners, told Reuters the incident highlights basic cyber hygiene failures. He noted that getting these systems wrong results in defrosted food. Munro suggested the attack could be carried out by individuals messing around rather than sophisticated state actors. He questioned why a nation-state would affect only a subset of French fridges when other nations have internet-connected devices available.
In the Netherlands, Ahold Delhaize, which owns Albert Heijn, announced it began a controlled restart of systems following a cybersecurity incident that started on Sunday. The Dutch cybersecurity watchdog NCSC said it saw no link to the French attack. Dutch broadcaster NOS reported that Albert Heijn identified servers in the US, Poland, Moldova, and Turkey used in the attack. NOS stressed this reveals nothing about where the hackers are located, as traffic can be easily routed through other countries. Security specialist Pim Takkenberg told NOS the servers were likely used to scout systems or attempt data theft.
The incident exposed thin food stocks in the Netherlands. Shops and distribution centers hold approximately six days’ supply between them, replenished continuously by just-in-time IT systems that can fail and depend on the power grid. A report by Clingendael and Erasmus University last month advised households to keep eight days of emergency food rather than three. It found severe weather combined with a major power and IT outage could take two weeks to recover from.
This report was produced in the Europe Brief News newsroom.
