French Supermarket Sabotage: Cyberattacks Trigger Mass Food Spoilage

Hundreds of supermarkets across France are grappling with tens of millions of euros in losses after cyberattacks remotely sabotaged industrial refrigeration systems. Between 11 and 13 October, attackers successfully accessed cooling controllers at several major chains, forcing fridges and freezers into prolonged defrost cycles that spoiled massive quantities of meat, frozen goods, and fresh produce.

The incident primarily affected stores under the Intermarché and Netto brands, managed by the Les Mousquetaires group, as well as Coopérative U. In some locations, temperatures in cooling units rose to approximately 50°C and remained there for several hours. While many stores were able to save their stock through rapid intervention by staff and contractors, others were forced to discard their entire inventory.

The Weaponisation of Operational Functions

The attacks did not rely on complex malware but instead exploited standard operational features. Attackers triggered the built-in defrost cycles found in almost all industrial refrigeration controllers. Because these cycles are often configured to suppress temperature alarms to avoid waking staff during scheduled maintenance, the sabotage remained undetected in many stores until the following morning.

Investigators and security agencies, including CERT-FR, identified that the primary targets were Danfoss AK-SM 800 and AK-SC 355 controllers, alongside some Dixell systems. Many of the affected devices were end-of-life models that no longer receive security updates. For instance, Danfoss ended support for the AK-SM 800 in May 2021 and the AK-SC 355 as far back as 2016.

Third-Party Contractors as the New Perimeter

A critical vulnerability identified in the wake of the attacks is the role of third-party refrigeration contractors. Supermarket operators rarely manage these controllers directly; instead, they rely on contractors who maintain remote access to adjust settings and monitor performance. In many cases, this access was provided through management interfaces exposed directly to the public internet without the protection of a firewall or virtual private network (VPN).

This architectural choice turns a routine maintenance task into a significant security risk. Danfoss has previously documented similar incidents involving exposed interfaces in other regions, noting that sites lacking proper network segmentation are frequent targets. Security experts warn that when a contractor manages the remote path via a public IP address, the store operator effectively cedes control of their security perimeter to a third party.

Insurance Gaps and Financial Consequences

The financial impact of the sabotage is exacerbated by a significant gap in insurance coverage. While many affected businesses hold cyber insurance policies, these frequently exclude physical losses. Industry experts indicate that spoiled stock is typically categorised as a physical loss rather than a digital one, leaving retailers to bear the costs of the discarded food themselves. Intermarché has already confirmed that its insurance did not cover the incident.

CERT-FR has advised operators to immediately remove all refrigeration management interfaces from the public internet and restore access only through protected networks. The agency also recommended that operators review their insurance contracts before altering data links to contractors, as some maintenance agreements require a constant data feed for performance guarantees.

Lessons for Industrial Control Systems

The French attacks mirror previous incidents involving operational technology (OT), such as the exploitation of water system controllers in the United States. These events highlight a growing trend where attackers use intended system functionality to cause physical disruption. Security researchers at CISA and other agencies have long advocated for a “secure-by-design” approach that prioritises the removal of industrial interfaces from the public web.

For supermarket operators and other sectors reliant on cold storage, the incident serves as a directive to audit remote access agreements. Experts recommend that maintenance contracts should strictly define remote access paths, require multi-factor authentication, and mandate that contractors provide logs of all remote activities. Additionally, monitoring should shift from simple temperature alarms to detecting unexpected mode changes or setpoint adjustments, which can provide an earlier warning of unauthorised access.