Remote tampering pushed refrigerator temperatures as high as 50°C in French supermarkets, spoiling stock at hundreds of stores. Belgium and the Netherlands faced separate retail disruptions, and investigators have not linked the incidents.
At some French supermarkets, refrigeration controls pushed temperatures as high as 50°C.
More than 200 stores found fresh and frozen food spoiled after attackers remotely altered refrigerator settings. Fires were reported at some locations. The same overnight wave hit retailers in Belgium and the Netherlands, disrupting shelf prices. Online orders and supply systems were also affected. Investigators have not established whether the attacks were connected.
In France, the manipulated cooling systems triggered rapid defrost cycles. Intermarché initially reported 150 affected stores and estimated losses in the tens of millions of euros. Carrefour reported 80 affected locations out of about 6,000 French stores, while most of its outlets continued operating without disruption. Monoprix counted about 24 affected stores, or 5% of its 490 French locations. Le Monde also reported that refrigeration equipment in one Intermarché store in Normandy reached 80°C.
Le Monde reported that a defrost cycle could be extended from one hour to eight, delaying the alarm as temperatures rose.
Published estimates of the wider French impact vary. AFP reported at least 300 affected Intermarché and Netto stores, more than 100 Coopérative U locations and several E.Leclerc stores. Other estimates put the nationwide total at roughly 250–350, but no final count has been established. Paris prosecutors opened a separate investigation to identify those affected. They are examining whether the cyberattack was linked to food losses, and are also investigating reported fires. Prime Minister Sébastien Lecornu ordered the National Cybersecurity Agency, ANSSI, to investigate.
The technical route remains unclear. An ANSSI source said a vulnerability in software supplied by Danish company Danfoss may have enabled the French attacks. AFP identified Danfoss AK-SM800 and AK-SC355 controllers among the affected systems. It reported that at least one AK-SM800 version was running outdated firmware. Danfoss said affected units had outdated firmware and that it had advised customers to update compatible systems. It also recommended moving legacy equipment to current-generation solutions. Public reporting has not confirmed that attackers exploited a specific CVE vulnerability or that Danfoss equipment was the sole point of compromise.
Infosecurity Magazine reported preliminary losses of about €270,000 in two Alsace stores, an Intermarché and a Super U. The estimate covers those two locations only and is not a nationwide damage total.
The disruptions in Belgium and the Netherlands took a different form. From Sunday 11 October, Delhaize and Albert Heijn displayed expired promotions on electronic shelf labels, leaving shelf prices out of step with checkout prices. Online ordering and customer-service platforms were disrupted, forcing both chains to disable their apps and websites. Loyalty and savings systems also stopped working.
Albert Heijn’s distribution centre in Tilburg was hacked, cutting the chain off from a key supply point. The company warned that some products might be unavailable in some stores in the coming days. Delhaize’s distribution centre remained operational, but the retailer said deliveries to independent operators were difficult. Orders placed online before the disruption were still being delivered on Monday. New online orders remained suspended for the rest of the week.
Ahold Delhaize said it had no evidence linking the French incident to the separate attacks on its Belgian and Dutch businesses. Sekoia analyst Felix Aime said similar episodes had also been recorded in Spain and Portugal. He also cited cases in Poland and Germany; the source provided no further details about them.
Thierry Cotillard, who leads Les Mousquetaires, owner of Intermarché and Netto, said the motive could be financial, including ransom demands. He also raised the possibility of political destabilisation. Cooperative U chief executive Dominique Schelcher called attacks on food preservation and supply equipment exceptionally serious. EU Agriculture Commissioner Christophe Hansen condemned the incidents and called for increased vigilance. Reporting on the attacks cited Reuters and EFE. It also cited AFP and local media.
