Refrigeration units at 150 Intermarche stores were reportedly heated to 122 degrees for six hours overnight, putting food supplies at risk. Reuters reports that the Paris prosecutor’s office called the cyberattack “large-scale” and said it affected “several major food retailers across France.”
Carrefour reported attacks on 80 of its supermarkets. Monoprix said about five percent of its 490 stores in France were affected. Intermarche CEO Thierry Cotillard told BFM TV, in remarks quoted by Reuters, that losses from the attack reached “tens of millions of euros nationwide in a single day.” He described it as “unprecedented.”
Dominique Schelcher, CEO of Cooperative U, said 80 of his supermarket locations were affected as well. He wrote in a statement on X: “Targeting equipment essential to the preservation of fresh products and to the food supply of the French people is of extreme gravity and is unprecedented,”
Supermarket refrigeration controls are reachable over the internet, so staff can check temperatures and change settings remotely. That same remote access is what attackers can target. France’s National Cybersecurity Agency (ANSSI) is reportedly investigating the incident and has found a vulnerability in software supplied by Danish firm Danfoss.
Danfoss told Reuters it was “aware of incidents in France affecting a limited number of refrigeration management systems” and that the affected units “were running outdated firmware.” Software updates released recently fixed vulnerabilities that cybersecurity firm Team82 identified in August. Reporting said the flaws could allow attackers to get past authentication controls and run code remotely.
The information available points to outdated software as a security concern, but doesn’t show precisely how attackers gained access to each system or whether they exploited the reported vulnerabilities at every affected store.
It’s not clear whether the French attacks are related to a separate security issue at Dutch retailer Ahold Delhaize. The company, which owns Food Lion and Giant in the US, said it had taken some systems offline as a precaution while dealing with a “security issue.” It said there was no reason to connect that issue with the incidents in France.
The attacker’s identity remains unknown. The article notes the possibility of AI involvement amid recent reports about AI’s role in hacking sprees, but offers no evidence that AI was used in this case. A CrowdStrike report published in February found a nearly 90 percent year-over-year increase in AI-enabled cyberattacks, though that broader figure doesn’t identify the tools used against the French retailers.
