Hackers heat French supermarket fridges, sparking fires and spoiling food

Fred Tanneau/AFP via Getty Images

Hackers raised the temperature of refrigerators and freezers ​at hundreds of French supermarkets to as high as 50 degrees Celsius (122 degrees Fahrenheit), causing fires and spoiling food.

The Paris prosecutor’s office said on Monday ‌that a “large-scale” attack was “affecting connected refrigerators in several major food retailers across France,” leading to food losses and fires.

Prime Minister Sebastien Lecornu has instructed France’s National Cybersecurity Agency (ANSSI) to investigate, a person in his office said.

France was coordinating with European counterparts because other countries could also be affected, the person said, adding that authorities were assessing whether other French companies were at risk.

Felix Aime, a senior cyber threat intelligence analyst ​at Sekoia Threat Detection and Research, said Spain, Portugal, Poland, Germany and Belgium had also been affected.

Carrefour said 80 of its supermarkets were hit, while Monoprix, which operates about 490 ​stores in France, said 5 per cent of its stores were affected.

Les Mousquetaires, owner of retailer Intermarche, said fridges at around 150 of its ⁠stores were heated up to 50 C for six hours overnight. A spokesperson said all affected food had been discarded to eliminate health risks.

Stephane Mahe/Reuters

Paris resident Geert de Clercq witnessed staff ​at an Intermarche in central Paris throwing cartfuls of defrosted frozen foods into a giant trash container, with molten ice cream sloshing out of broken tubs on the street.

Cooperative U CEO ​Dominique Schelcher said his supermarket group had also been targeted.

“Targeting equipment essential to the preservation of fresh products and to the food supply of the French people is of extreme gravity and is unprecedented,” he wrote on X.

Food retailers E.Leclerc and Auchan did not respond to requests for comment.

There was no immediate estimate of industry-wide losses, but Intermarche CEO Thierry Cotillard told BFM TV the “unprecedented” attack would represent losses amounting to “tens ​of millions of euros nationwide in a single day.”

Christel Delberghe, director general at European retail association Eurocommerce, said, “This incident underlines the importance of resilience across the entire supply chain.”

Supermarket cold aisles are typically run by control panels that manage an entire store’s fridges and freezers and can be accessed over the internet, which lets maintenance companies adjust them from anywhere.

The source ‌close to ⁠Lecornu said ANSSI had identified a vulnerability in software supplied by Danish company Danfoss.

Danfoss said it was “aware of incidents in France affecting a limited number of refrigeration management systems”.

The affected units “were running outdated firmware,” Danfoss said, adding that it had “long advised customers to keep supported systems updated with the latest firmware and to migrate legacy systems to current-generation solutions.”

On August 9, cybersecurity firm Claroty’s Team82 published research detailing vulnerabilities in the Danfoss AK-SM 800A controller. According to the report, software updates issued by Danfoss addressed issues that could have allowed attackers to bypass ​authentication controls and execute code on compromised devices.

The ​attacks resemble disruptions reported at about a ⁠dozen US military commissaries in late August that led to food losses after fridges were affected.

In a statement, French retail association Fédération du Commerce et de la Distribution called for “full transparency” from Danfoss about the incident. It said supermarkets aimed to protect consumers and return to ​normal operations as soon as possible. The FCD said some impacted stores were already back up and running.

Dutch retailer ​Ahold Delhaize, which operates the ⁠Netherlands’ largest supermarket chain Albert Heijn and has major operations in the US, said it was dealing with a “security issue” on its network and had taken several systems offline as a precaution.

A message on the retailer’s smartphone app said it was unable to deliver groceries because of a “cybersecurity incident”.

Online orders account for about 10 per cent of Albert Heijn sales. Physical stores remained open, while Dutch news ⁠agency ANP ​reported that rival retailers had seen a surge in delivery orders.

Ahold Delhaize said there was no reason to ​see a link between the incidents in France and its supermarkets.

Ahold is the fourth-largest grocery retailer in the US. Websites for its Stop & Shop, Giant, Hannaford and Food Lion chains displayed notices saying “site temporarily down”.

Fred Tanneau/AFP via Getty Images

黑客将数百家法国超市的冰箱和冰柜温度调高至 50 摄氏度（122 华氏度），导致火灾和食物变质。

巴黎检察官办公室周一表示，一起“大规模”攻击“影响了法国多家大型食品零售商的联网冰箱”，导致食品损失和火灾。

据总理塞巴斯蒂安·勒科尔努办公室的一位人士透露，总理已指示法国国家网络安全局（ANSSI）对此事展开调查。

该人士表示，法国正在与欧洲其他国家协调，因为其他国家也可能受到影响；他还补充说，当局正在评估其他法国公司是否面临风险。

Sekoia威胁检测与研究公司的高级网络威胁情报分析师Felix Aime表示，西班牙、葡萄牙、波兰、德国和比利时也受到了影响。

家乐福表示，旗下 80 家超市受到影响；而拥有约 490 家门店的法国超市 Monoprix 表示，旗下 5% 的门店受到影响。

Intermarche 的母公司 Les Mousquetaires 表示，旗下约 150 家门店的冰箱在夜间被加热至 50 摄氏度，持续六小时。一位发言人称，所有受影响的食品均已被丢弃，以消除健康风险。

Stephane Mahe/路透社

巴黎居民吉尔特·德·克莱克亲眼目睹巴黎市中心一家 Intermarche 超市的工作人员将一车车解冻的冷冻食品扔进一个巨大的垃圾桶，融化的冰淇淋从破损的冰淇淋桶里流出来，洒在街上。

Cooperative U 首席执行官 Dominique Schelcher 表示，他的超市集团也成为了攻击目标。

“针对对法国人民保鲜产品和食品供应至关重要的设备进行攻击，事态极其严重，史无前例，”他在 X 上写道。

食品零售商 E.Leclerc 和 Auchan 没有回应置评请求。

目前尚无对整个行业损失的立即估计，但 Intermarche 首席执行官 Thierry Cotillard 告诉 BFM 电视台，这次“史无前例”的袭击将造成“全国范围内一天内数千万欧元的损失”。

欧洲零售协会 Eurocommerce 的总干事 Christel Delberghe 表示：“这一事件凸显了整个供应链韧性的重要性。”

超市冷藏通道通常由控制面板控制，这些控制面板可以管理整个商店的冰箱和冷柜，并且可以通过互联网访问，这使得维护公司可以从任何地方进行调整。

接近勒科尔努的消息人士称，法国国家安全信息系统管理局 (ANSSI) 已发现丹麦公司丹佛斯提供的软件存在漏洞。

丹佛斯表示，“已知晓法国发生的一些事件影响了数量有限的制冷管理系统”。

丹佛斯表示，受影响的设备“运行的是过时的固件”，并补充说，该公司“长期以来一直建议客户将受支持的系统更新到最新固件，并将旧系统迁移到当前一代的解决方案”。

8月9日，网络安全公司Claroty旗下的Team82发布研究报告，详细披露了丹佛斯AK-SM 800A控制器的漏洞。报告指出，丹佛斯发布的软件更新修复了可能允许攻击者绕过身份验证控制并在受感染设备上执行代码的问题。

这些袭击事件与 8 月下旬美国十几个军需品商店发生的骚乱事件类似，当时冰箱受损，导致食品损失。

法国零售协会Fédération du Commerce et de la Distribution在一份声明中呼吁丹佛斯公司就此次事件保持“完全透明”。该协会表示，超市的目标是保护消费者，并尽快恢复正常运营。FCD还表示，部分受影响的门店已经恢复营业。

荷兰零售商 Ahold Delhaize 运营着荷兰最大的连锁超市 Albert Heijn，并在美国拥有大量业务。该公司表示，其网络出现“安全问题”，并已出于预防措施将多个系统离线。

该零售商的智能手机应用程序上显示一条消息称，由于“网络安全事件”，无法配送杂货。

线上订单约占 Albert Heijn 销售额的 10%。实体店继续营业，而荷兰通讯社 ANP 报道称，竞争对手的零售商的送货订单激增。

Ahold Delhaize表示，没有理由认为法国发生的这些事件与其超市之间存在联系。

Ahold是美国第四大食品零售商。旗下Stop & Shop、Giant、Hannaford和Food Lion连锁超市的网站均显示“网站暂时无法访问”的通知。