Danfoss Vulnerability Triggers Massive Cyberattack on French Supermarket Fridges

Key points

• Hackers remotely triggered forced defrosting in refrigeration units, raising temperatures to as high as 50°C (122°F) in affected stores.
• Major retailers including Intermarché, Cooperative U, Carrefour, and Monoprix confirmed significant store impacts, with Intermarché reporting at least 300 affected locations.
• France’s National Cybersecurity Agency (ANSSI) identified a vulnerability in software supplied by Danish company Danfoss, specifically in legacy systems running outdated firmware.
• The attack caused fires and massive food spoilage, with Intermarché CEO Thierry Cotillard estimating nationwide losses in the tens of millions of euros.
• Prime Minister Sebastien Lecornu ordered an investigation, and France is coordinating with European counterparts as similar incidents were reported in the Netherlands and other countries.

Background

This incident follows earlier reports of similar disruptions in the US and Europe, highlighting growing concerns over the security of internet-connected industrial equipment. Previous archive coverage noted that while the full scope of the French attack was initially unclear, it mirrored a pattern of targeting legacy software in critical infrastructure, prompting calls for stricter cybersecurity measures across the supply chain.

How outlets are covering it

While all outlets agree on the scale and impact of the attack, they differ in emphasis. Al Jazeera and CNN focus on the technical vulnerability in Danfoss software and the potential for similar attacks on other critical infrastructure like energy or hospitals. CBS News highlights the broader context of hybrid attacks and the EU commissioner’s warning about the weaponization of food. BBC provides specific local details, such as losses in the Alsace region and staff experiences, while noting the lack of immediate industry-wide loss estimates. All sources confirm the involvement of major French retailers and the subsequent government response.

Why it matters

The attack underscores the critical vulnerability of internet-connected industrial equipment, particularly legacy systems, to cyber threats. It highlights the potential for cyberattacks to disrupt essential services like food supply, leading to significant economic losses and public safety risks. The incident has prompted calls for national and international measures to strengthen cybersecurity in critical infrastructure, as similar vulnerabilities could be exploited in other sectors such as energy or healthcare.

What to watch

France’s National Cybersecurity Agency (ANSSI) is investigating the vulnerability in Danfoss software and coordinating with European counterparts to assess the risk to other companies. Danfoss has advised customers to update their systems, and retailers are working to restore normal operations. The Paris prosecutor’s office is investigating the attack to identify victims and establish links to reported damages, while cybersecurity experts warn that similar attacks could target other critical infrastructure in the future.