French Supermarkets Discard Millions in Food After Cyberattack Overheats Fridges

Key points

• The attack affected over 400 stores across five major French chains, including Carrefour, Monoprix, Les Mousquetaires, E. Leclerc, and Coopérative U.
• Refrigerators in affected stores heated up to 50°C (122°F) for up to six hours, causing massive food spoilage and triggering fire alarms in some locations.
• Experts estimate the financial losses to be upwards of €10 million, with some executives suggesting the total could reach tens of millions of euros nationwide.
• The attack targeted legacy refrigeration control systems from Danish manufacturer Danfoss, which no longer receive security updates.
• French Prime Minister Sébastien Lecornu has ordered the National Cybersecurity Agency (ANSSI) to investigate the incident, while the Paris prosecutor's office has opened a formal inquiry.

Background

This incident follows a broader wave of cyberattacks targeting critical infrastructure and supply chains across Europe. Recent attacks have included breaches of US water utilities and a UK power plant, raising concerns about the weaponization of essential services. The vulnerability exploited in this attack highlights the risks associated with legacy software in critical infrastructure, a concern that has been growing as AI-enhanced cyberattacks become more prevalent.

How outlets are covering it

Fox News and Reuters emphasized the scale of the attack and the financial losses, while CNBC highlighted the cross-border nature of the incident, noting that it affected supermarkets in Spain, Portugal, Poland, Germany, and Belgium. The New York Times focused on the technical details, identifying the attack as targeting systems from three refrigeration companies, including Danfoss. European Commissioner Christophe Hansen condemned the attack as an affront to food safety, calling it a 'weaponization of food.'

Why it matters

This incident underscores the vulnerability of critical infrastructure to cyberattacks and the potential for such attacks to disrupt essential services like food supply. The use of legacy software in refrigeration systems highlights the need for improved cybersecurity measures in the retail and food industries. The incident also raises concerns about the growing threat of AI-enhanced cyberattacks, which can target multiple victims at once and increase the scale and speed of attacks.

What to watch

French authorities are expected to continue their investigation into the attack, with the National Cybersecurity Agency (ANSSI) working to identify the culprits. The Paris prosecutor's office has opened a formal inquiry, and experts are expected to provide more precise figures on the financial losses. The incident may also lead to increased scrutiny of legacy software in critical infrastructure and calls for improved cybersecurity measures in the retail and food industries.