A major cyberattack has struck supermarket chains across France, Belgium, and the Netherlands, with hackers remotely manipulating refrigeration systems to trigger forced defrosting at temperatures reaching 50°C (122°F). The attack, described as "unprecedented" by industry leaders, has caused fires, widespread food spoilage, and significant supply chain disruption.
French retailers Intermarché, E. Leclerc, and Coopérative U confirmed they were hit.
Intermarché reported that around 150 stores were affected, with fridges heated for six hours, forcing the disposal of all fresh and frozen products to avoid sanitary risks. Coopérative U CEO Dominique Schelcher called the targeting of food preservation equipment "extremely serious and unprecedented."
Paris prosecutors confirmed the large-scale attack, which reportedly affected several hundred stores. Prime Minister Sébastien Lecornu instructed France's cybersecurity agency ANSSI to investigate.
ANSSI recognised a vulnerability in software supplied by Danish company Danfoss, whose refrigerator management systems were targeted. Danfoss, however, stated that affected units were running outdated firmware and urged customers to update systems.
The attack also caused disruption of electronic shelf labels and delivery systems. In the Netherlands, there was a "security issue" in Ahold Delhaize, causing disruption of systems in Albert Heijn, Etos, and Gall & Gall supermarkets.
Belgian Delhaize supermarkets were also disrupted by the attacks. Whether or not the two disruptions are related is yet to be confirmed.
EU Commissioner for Food and Agriculture, Christophe Hansen, denounced the attack, warning that "food security requires more attention at all levels." The early losses from the attacks are estimated to be about €300,000, which could amount to millions across the country. The situation reveals how vulnerable interconnected systems are, with experts asking why refrigeration systems were made internet-accessible.