French Supermarkets Cyberattack: “This is not a closed incident we’re performing an autopsy on”

Last weekend, a massive cyberattack surprised the main French supermarket chains. Companies like Intermarché, Carrefour, or Auchan experienced issues with the refrigeration systems in dozens of their establishments. The consequences were immediate. Countless perishable products spoiled due to the high temperatures reached by the machines, and in the most extreme cases, fires had to be extinguished in the supermarkets.

This is the first time such an effective large-scale attack has occurred against the food distribution sector. But could it have been avoided? How is it possible that the incident affected so many food distribution giants? We spoke with cybersecurity experts to find out exactly what happened and what went wrong.

To understand what happened, one must virtually travel to Denmark and go back to 2023. That year, the offensive security specialized firm Synacktiv documented and reported critical flaws in the store and refrigeration systems of the Danish manufacturer Danfoss, a supplier to most French supermarket chains.

The cybersecurity company warned three years ago of an authentication bypass flaw that allowed remote administrative control of the equipment without a password. Synacktiv clearly warned that exploiting these vulnerabilities in Internet-connected devices without proper protection could allow attackers to remotely manipulate thermal parameters and force shutdowns or defrosts in climate control and cold chain systems.

When these problems were detected, they were communicated to Danfoss as part of the usual responsible disclosure. The Danish company quickly informed (within two weeks) its customers, indicating that the affected equipment was obsolete and asking them to isolate the vulnerable machines. However, although they provided a solution for compatible equipment, they did not offer any patch for those old machines.

“These controllers usually operate for years without updates, and their patching depends on operators and maintenance contractors, not just the manufacturer. The potential impact of these vulnerabilities in real environments was probably underestimated,” comments Kevin Teller, a security auditor at Synacktiv and one of the authors of that finding, for Digital Shield.

For Teller, it is very likely that the big supermarket chains did not do their homework. “The affected models were no longer supported by the provider. The vulnerable devices are still in use; these systems can be quite costly, and replacing this type of equipment every ten years can be challenging for distributors and independent stores due to operational costs. We still do not know if only obsolete devices were exploited,” he notes.

Synacktiv was not the only one to alert about such problems. At the beginning of last year, the IoT security-specialized company Claroty raised the alarm again, explicitly warning about the risk of malicious temperature manipulation. Shortly after, in March, Danfoss issued a security advisory and updated its customers with new firmware that addressed these vulnerabilities. But not everyone updated, and the reasons for this are much more complex than a simple oversight or poor performance by the CISOs.

“The visibility of asset information (serial numbers, product numbers, communication protocols, etc.) allows organizations to create complete inventories and correlate that information with known vulnerabilities. Without adequate visibility of existing assets and how and where they communicate, it is difficult to apply mitigation measures, patches, and comprehensive controls,” explains Amir Preminger, CTO of Claroty and head of Team82, for Digital Shield.

“Historically, organizations have operated under the premise that these specialized refrigeration controllers were isolated from central networks, but current cybercriminals use publicly available scanning and artificial intelligence tools to actively search for OT devices connected to the Internet. Companies are in a race against time where attackers can escalate faster than traditional patching and updating programs allow,” he adds.

Beyond this agility of AI to ‘do evil,’ another aspect highlighted by the French authorities needs to be emphasized. The alert was not limited to a single brand but to four families of equipment from three different manufacturers sharing the same underlying vulnerability. In short, machines connected to the Internet without anyone watching them. Besides Danfoss and its AK-SM and AK-SC series, Copeland and Dixell were also involved.

An attack that marks a new stage for digital security

The severe consequences of the cyberattack on the food distribution sector (hundreds of stores affected and millions of euros in losses) lead to the thought that this incident is unparalleled and that perhaps we are facing a new NOTPetya. However, it is not the first time something similar has happened.

In 2022, a very similar scenario had already occurred in Russia: attackers accessed a Danfoss controller at the Seliatino agro-industrial center near Moscow, created an account with full privileges, and attempted to increase the temperature of frozen food freezers. The equipment was perfectly accessible from the Internet for monitoring and remote manipulation. It could have been a great “when you see your neighbor’s beard being cut, put yours to soak,” but it was not.

The shadow of sabotage

One of the questions that have not yet been answered about the incident is who or who are behind it. With no economic interests involved or a ransom demand, everything points to a state-linked threat actor.

For Carlos Castro, director of strategic accounts at WatchGuard Spain, in the absence of a public claim, “the intention to provoke economic sabotage, causing direct losses and the interruption of activity, is clear.” Castro does not rule out the presence of a geopolitical component linked to hybrid warfare campaigns and evokes key precedents such as the attack on the Target chain in 2013 — perpetrated through a climate control provider — or the Colonial Pipeline case in 2021.

Borja Pérez, Country Manager of Stormshield Iberia, places the root of this type of physical impact incidents in the famous Stuxnet precedent in 2010, which “opened the doors to this type of attack by demonstrating that software could break a physical infrastructure.” However, he clarifies that, unlike nuclear facilities, in supermarket chains “the goal is more social and economic impact,” noting that the global volume of losses in this incident already stands at tens of millions of euros.

An important nuance is to analyze the cyberattack based on what did not happen that night. “What stands out the most is what does not appear. There is no known ransom demand, no data theft has been reported, and the damage is physical, immediate, and irreversible: food that must be thrown away,” analyzes Juan Carlos Cornago, Director of Cybersecurity at Babel.

“There is a detail that seems more revealing than any motivation,” he continues. “On the same night, chains competing with each other fell, Intermarché, Netto, Coopérative U, Monoprix, Carrefour Market, and Super U. Whoever attacks a supermarket chain wants to harm that chain. Whoever attacks a category of controller takes down everyone who has it, without choosing a victim. With what has been published so far, that points more to the type of equipment than to a specific company,” he adds.

According to Prosegur Cybersecurity’s analysis, supply chain attacks recorded an average cost of 4.33 million euros per incident in 2025. For its director, David Fernández, “the challenge is no longer just to prevent an intrusion but to ensure the resilience of organizations against threats capable of transferring their consequences from the digital to the physical environment.”

How to avoid attacks of this type

Given what happened, it is clear that the first step to avoiding a security breach of this magnitude is to have updated equipment and discard those that, due to their age, are not easy to maintain.

For Teller, updating is necessary but not sufficient. The expert insists that “these controllers should never be connected directly to the Internet.”

That refrigerators do not show visible problems does not mean they do not have them. Another key is to assume that it is not enough to check that the devices are connected and working correctly.

“We also need to know what’s happening with them, how they behave, and if they are making communications they shouldn’t. This is especially important when we are talking about hundreds or thousands of machines spread across different locations, some of which are more complex to access through IT departments,” advises Xabier Olea, Technical Director of Wireless Logic.

In this regard, it is necessary to know if those devices are establishing connections with unknown IP addresses or generating data traffic that does not correspond to their usual activity. “Detecting such behaviors in time can be crucial to identifying a possible threat before it affects the service,” suggests Olea.

Claroty suggests controlling all internal and third-party remote access with a centralized and secure tool, which would eliminate the need for devices to be publicly accessible via HTTP/HTTPS. “This centralized tool offers precise control over who can access what, when, and for what purpose. It also allows detailed session tracking and screen recording of all of them, if necessary, to facilitate incident investigation,” he details.

The Director of Cybersecurity at Babel has a diametrically opposed opinion regarding centralized architecture. For him, it is a double-edged sword.

“The difference between your home refrigerator and a commercial refrigeration installation is that the latter is designed for someone to manage it from afar. A centralized manager coordinates all the cameras in a store, and in many chains, a single point reaches several stores at once. That concentration is what makes maintenance viable. It is also what turns a single access into a national incident,” he comments.

As Cornago recalls, the Picard chain was able to avoid the impact because “its refrigeration is decentralized store by store, so there is no single point from which to reach them all.” According to him, the group was not spared by having better security but “by being less connected.”

It is time for companies and manufacturers to get their act together. This may be just the beginning. CERT-FR has warned that campaigns are likely to continue. “This is not a closed incident we’re performing an autopsy on,” they conclude from Babel. 

Last weekend, a massive cyberattack surprised the main French supermarket chains. Companies like Intermarché, Carrefour, or Auchan experienced issues with the refrigeration systems in dozens of their establishments. The consequences were immediate. Countless perishable products spoiled due to the high temperatures reached by the machines, and in the most extreme cases, fires had to be extinguished in the supermarkets.

This is the first time such an effective large-scale attack has occurred against the food distribution sector. But could it have been avoided? How is it possible that the incident affected so many food distribution giants? We spoke with cybersecurity experts to find out exactly what happened and what went wrong.

To understand what happened, one must virtually travel to Denmark and go back to 2023. That year, the offensive security specialized firm Synacktiv documented and reported critical flaws in the store and refrigeration systems of the Danish manufacturer Danfoss, a supplier to most French supermarket chains.

The cybersecurity company warned three years ago of an authentication bypass flaw that allowed remote administrative control of the equipment without a password. Synacktiv clearly warned that exploiting these vulnerabilities in Internet-connected devices without proper protection could allow attackers to remotely manipulate thermal parameters and force shutdowns or defrosts in climate control and cold chain systems.

When these problems were detected, they were communicated to Danfoss as part of the usual responsible disclosure. The Danish company quickly informed (within two weeks) its customers, indicating that the affected equipment was obsolete and asking them to isolate the vulnerable machines. However, although they provided a solution for compatible equipment, they did not offer any patch for those old machines.

“These controllers usually operate for years without updates, and their patching depends on operators and maintenance contractors, not just the manufacturer. The potential impact of these vulnerabilities in real environments was probably underestimated,” comments Kevin Teller, a security auditor at Synacktiv and one of the authors of that finding, for Digital Shield.

For Teller, it is very likely that the big supermarket chains did not do their homework. “The affected models were no longer supported by the provider. The vulnerable devices are still in use; these systems can be quite costly, and replacing this type of equipment every ten years can be challenging for distributors and independent stores due to operational costs. We still do not know if only obsolete devices were exploited,” he notes.

Synacktiv was not the only one to alert about such problems. At the beginning of last year, the IoT security-specialized company Claroty raised the alarm again, explicitly warning about the risk of malicious temperature manipulation. Shortly after, in March, Danfoss issued a security advisory and updated its customers with new firmware that addressed these vulnerabilities. But not everyone updated, and the reasons for this are much more complex than a simple oversight or poor performance by the CISOs.

“The visibility of asset information (serial numbers, product numbers, communication protocols, etc.) allows organizations to create complete inventories and correlate that information with known vulnerabilities. Without adequate visibility of existing assets and how and where they communicate, it is difficult to apply mitigation measures, patches, and comprehensive controls,” explains Amir Preminger, CTO of Claroty and head of Team82, for Digital Shield.

“Historically, organizations have operated under the premise that these specialized refrigeration controllers were isolated from central networks, but current cybercriminals use publicly available scanning and artificial intelligence tools to actively search for OT devices connected to the Internet. Companies are in a race against time where attackers can escalate faster than traditional patching and updating programs allow,” he adds.

Beyond this agility of AI to ‘do evil,’ another aspect highlighted by the French authorities needs to be emphasized. The alert was not limited to a single brand but to four families of equipment from three different manufacturers sharing the same underlying vulnerability. In short, machines connected to the Internet without anyone watching them. Besides Danfoss and its AK-SM and AK-SC series, Copeland and Dixell were also involved.

An attack that marks a new stage for digital security

The severe consequences of the cyberattack on the food distribution sector (hundreds of stores affected and millions of euros in losses) lead to the thought that this incident is unparalleled and that perhaps we are facing a new NOTPetya. However, it is not the first time something similar has happened.

In 2022, a very similar scenario had already occurred in Russia: attackers accessed a Danfoss controller at the Seliatino agro-industrial center near Moscow, created an account with full privileges, and attempted to increase the temperature of frozen food freezers. The equipment was perfectly accessible from the Internet for monitoring and remote manipulation. It could have been a great “when you see your neighbor’s beard being cut, put yours to soak,” but it was not.

The shadow of sabotage

One of the questions that have not yet been answered about the incident is who or who are behind it. With no economic interests involved or a ransom demand, everything points to a state-linked threat actor.

For Carlos Castro, director of strategic accounts at WatchGuard Spain, in the absence of a public claim, “the intention to provoke economic sabotage, causing direct losses and the interruption of activity, is clear.” Castro does not rule out the presence of a geopolitical component linked to hybrid warfare campaigns and evokes key precedents such as the attack on the Target chain in 2013 — perpetrated through a climate control provider — or the Colonial Pipeline case in 2021.

Borja Pérez, Country Manager of Stormshield Iberia, places the root of this type of physical impact incidents in the famous Stuxnet precedent in 2010, which “opened the doors to this type of attack by demonstrating that software could break a physical infrastructure.” However, he clarifies that, unlike nuclear facilities, in supermarket chains “the goal is more social and economic impact,” noting that the global volume of losses in this incident already stands at tens of millions of euros.

An important nuance is to analyze the cyberattack based on what did not happen that night. “What stands out the most is what does not appear. There is no known ransom demand, no data theft has been reported, and the damage is physical, immediate, and irreversible: food that must be thrown away,” analyzes Juan Carlos Cornago, Director of Cybersecurity at Babel.

“There is a detail that seems more revealing than any motivation,” he continues. “On the same night, chains competing with each other fell, Intermarché, Netto, Coopérative U, Monoprix, Carrefour Market, and Super U. Whoever attacks a supermarket chain wants to harm that chain. Whoever attacks a category of controller takes down everyone who has it, without choosing a victim. With what has been published so far, that points more to the type of equipment than to a specific company,” he adds.

According to Prosegur Cybersecurity’s analysis, supply chain attacks recorded an average cost of 4.33 million euros per incident in 2025. For its director, David Fernández, “the challenge is no longer just to prevent an intrusion but to ensure the resilience of organizations against threats capable of transferring their consequences from the digital to the physical environment.”

How to avoid attacks of this type

Given what happened, it is clear that the first step to avoiding a security breach of this magnitude is to have updated equipment and discard those that, due to their age, are not easy to maintain.

For Teller, updating is necessary but not sufficient. The expert insists that “these controllers should never be connected directly to the Internet.”

That refrigerators do not show visible problems does not mean they do not have them. Another key is to assume that it is not enough to check that the devices are connected and working correctly.

“We also need to know what’s happening with them, how they behave, and if they are making communications they shouldn’t. This is especially important when we are talking about hundreds or thousands of machines spread across different locations, some of which are more complex to access through IT departments,” advises Xabier Olea, Technical Director of Wireless Logic.

In this regard, it is necessary to know if those devices are establishing connections with unknown IP addresses or generating data traffic that does not correspond to their usual activity. “Detecting such behaviors in time can be crucial to identifying a possible threat before it affects the service,” suggests Olea.

Claroty suggests controlling all internal and third-party remote access with a centralized and secure tool, which would eliminate the need for devices to be publicly accessible via HTTP/HTTPS. “This centralized tool offers precise control over who can access what, when, and for what purpose. It also allows detailed session tracking and screen recording of all of them, if necessary, to facilitate incident investigation,” he details.

The Director of Cybersecurity at Babel has a diametrically opposed opinion regarding centralized architecture. For him, it is a double-edged sword.

“The difference between your home refrigerator and a commercial refrigeration installation is that the latter is designed for someone to manage it from afar. A centralized manager coordinates all the cameras in a store, and in many chains, a single point reaches several stores at once. That concentration is what makes maintenance viable. It is also what turns a single access into a national incident,” he comments.

As Cornago recalls, the Picard chain was able to avoid the impact because “its refrigeration is decentralized store by store, so there is no single point from which to reach them all.” According to him, the group was not spared by having better security but “by being less connected.”

It is time for companies and manufacturers to get their act together. This may be just the beginning. CERT-FR has warned that campaigns are likely to continue. “This is not a closed incident we’re performing an autopsy on,” they conclude from Babel. 

Become a premium member for free!