Hackers Turn Up Heat on French Supermarket Fridges, Triggering Fires and Food Losses
Hackers are raising concerns over the vulnerability of supermarket cooling equipment in France, as cyberattacks disrupt refrigeration and lead to costly damage.
Hackers have targeted supermarket refrigeration systems in France, triggering fires and causing losses of food products.
Hackers raised the temperature of fridges and freezers at hundreds of French supermarkets to as high as 50°C overnight last week, spoiling food and causing fires in some stores. Carrefour, Monoprix, Intermarché and Coopérative U were among the chains affected, and Intermarché’s chief executive said his group alone faced losses in the tens of millions of euros in a single day.
French prosecutors and the national cybersecurity agency are investigating, and no group has claimed responsibility. The losses put cyber and property insurers in focus, as policy wording will decide who bears the cost of spoiled stock and fire damage caused by a cyberattack.
Hackers: What Happened
The Paris prosecutor’s office opened an investigation into what it described as a large-scale cyberattack on connected refrigeration at several major food retailers. Prime Minister Sébastien Lecornu asked the national cybersecurity agency, ANSSI, to investigate. France is also coordinating with other European countries, as more may be affected. A threat analyst at the security firm Sekoia said Spain, Portugal, Poland, Germany and Belgium also showed signs of impact.
Also Read: Bandhan Group Eyeing Health Insurance Entry: Chairman Ghosh
Several major chains confirmed they were hit. Carrefour said 80 of its supermarkets were affected, out of about 6,000 stores. Monoprix said about 5% of its 490 French stores were hit. Les Mousquetaires, the owner of Intermarché, said around 150 of its stores had temperatures at 50°C for six hours, and all affected food was discarded. Coopérative U also confirmed it was targeted, and E.Leclerc was reported to have been affected. Intermarché’s chief executive said the group alone could lose tens of millions of euros in a single day.
Hackers – How the Attack Worked
Supermarket fridges are usually run from a central control unit that manages every fridge and freezer in the store. These units are often connected to the internet so maintenance companies can adjust settings remotely. Security analysts say the attackers took over these controllers and used the built-in defrost function, removing the limits that normally stop temperatures from rising.
French authorities pointed to software from Danish manufacturer Danfoss. The company said the affected units were running outdated firmware, and that many were older models that no longer receive updates. It said it had long advised customers to update or replace such systems. Danfoss has not said how many systems were hit.
Security firm Claroty had earlier reported flaws in a related Danfoss controller, which Danfoss then fixed. Neither the company nor French authorities has confirmed that these flaws were used in this attack. ANSSI has said that controllers from at least three suppliers were compromised: Danfoss, Copeland and Dixell. Researchers found well over a thousand Danfoss systems exposed to the internet in France alone.
A similar incident was reported at about a dozen US military commissaries in late August. Separately, Dutch retailer Ahold Delhaize, which owns Albert Heijn, had a cybersecurity incident that disrupted online orders and deliveries. Dutch authorities said there is no reason to link it to the French attacks.
Hackers – What It Means for Insurers
Reports so far do not say how much of the loss is insured. The case shows why policy wording matters in both cyber and property cover. Whether food losses caused by a cyberattack are covered depends on whether the policy includes cyber-triggered spoilage or excludes it. Fires started by a cyberattack can fall between cyber and property cover, and business interruption cover may depend on whether the loss comes from physical damage, a system failure or both. Attacks that come through a supplier’s software or a maintenance provider can also raise questions about who is liable.
For retailers, the basic steps remain the same: keep controller firmware updated, replace equipment that no longer gets security updates, and do not leave management panels open to the internet. Insurers may also start asking about these controls at underwriting.
