Cyber Sabotage: Massive Attack on IoT Cooling Systems Paralyzes European Supermarkets

In an unprecedented strike against retail infrastructure, a massive coordinated cyberattack has crippled the cooling systems of hundreds of supermarkets across France and neighboring European countries. The breach, which targeted the internet-connected refrigerators and freezers used to store perishable goods, resulted in temperatures being spiked to an extreme 50 degrees Celsius. This sudden surge in heat not only rendered vast quantities of food unsafe for consumption but also triggered electrical fires in several locations, posing a direct threat to both property and public safety.

The scale of the devastation is evident across France's largest retail chains. Carrefour reported that 80 of its outlets were compromised, while the Monoprix chain saw approximately 5% of its nearly 490 stores affected. Perhaps the hardest hit was the Les Mousquetaires group, which operates the Intermarche brand; the group confirmed that refrigerators in roughly 150 stores were subjected to these extreme temperatures for a continuous six-hour window overnight. The result was a catastrophic loss of inventory. In central Paris, witnesses described scenes of chaos as employees were forced to discard mountains of thawed frozen goods and melted ice cream into oversized waste bins, with liquids leaking onto the streets.

Dominique Schelcher, CEO of the Cooperative U group, emphasized the gravity of the situation, describing the attack as "unprecedented" and "extremely serious" given that it targeted systems vital for food security and the preservation of fresh produce. While a total industry-wide loss figure has not yet been finalized, Thierry Cotillard, CEO of Intermarche, indicated that the daily financial damage alone could reach tens of millions of euros.

The technical root of the crisis lies in the vulnerability of the Industrial Internet of Things (IIoT). Most modern supermarkets utilize centralized control panels to manage their cooling zones remotely, allowing maintenance companies to adjust settings via the web. Investigations conducted by the French National Cybersecurity Agency (ANSSI), acting under orders from Prime Minister Sebastien Lecornu, have pinpointed a security flaw in software provided by the Danish company Danfoss. Specifically, the attack targeted the AK-SM 800A controllers. Danfoss has since acknowledged the incident, noting that the affected units were running outdated firmware. The company stated that it had long advised clients to migrate to newer generations of software or update existing systems to the latest patches.

This vulnerability was not entirely unknown to the security community. In August, a research report by Team82, a division of the cybersecurity firm Claroty, had already detailed the flaws in the Danfoss controllers, noting that the vulnerabilities could allow unauthorized actors to bypass authentication and execute malicious code. Despite the availability of fixes, many retailers had apparently failed to update their systems, leaving a digital backdoor open for attackers.

The geopolitical scope of the attack extends far beyond French borders. Analysis from Felix Aime of Sekoia Threat Detection and Research suggests that retail operations in Spain, Portugal, Poland, Germany, and Belgium were similarly impacted. This has prompted France to coordinate with European partners to assess whether other critical infrastructure companies are at risk of a similar breach.

Adding to the regional instability, the Dutch retail giant Ahold Delhaize reported simultaneous security issues that forced the temporary shutdown of several systems, including grocery delivery services for its Albert Heijn chain. While Ahold Delhaize stated there is no evidence that their issues are directly linked to the French attack, the coincidence has heightened anxieties regarding the fragility of the global food supply chain. This pattern echoes a similar incident from late August, where several military food suppliers in the United States suffered system failures that led to significant food loss.

As some stores begin to resume operations, the French Retail Association has demanded full transparency from Danfoss. The industry is now calling for a comprehensive overhaul of how IoT devices are managed within the food sector to ensure that a software vulnerability cannot be weaponized to destroy millions of euros in resources and jeopardize public health.