Source: AFP, BFM TV

Major French supermarket chains confirmed on Monday that they were hit by a cyberattack that caused refrigeration systems to defrost in hundreds of stores, forcing the disposal of spoilt fresh and frozen food and raising serious questions about the security of connected industrial equipment. E. Leclerc, Intermarche and Cooperative U all confirmed the attack, with Cooperative U chief executive Dominique Schelcher describing it as unprecedented. At least 300 Intermarche and Netto shops and more than 100 Cooperative U outlets were affected, along with several E. Leclerc stores. Paris prosecutors have opened an investigation, noting that the incident also sparked fires in some locations.

A supply chain problem, not a single store problem

According to a source close to the French prime minister, France’s cybersecurity agency has identified a vulnerability in software supplied by a Danish company and has contacted the vendor, and reported refrigeration control systems from Danish manufacturer Danfoss were targeted. E. Leclerc confirmed that a cyberattack affected one of its refrigeration equipment suppliers, with repercussions on refrigeration systems in several stores. The agency is liaising with its European counterparts because other countries may be affected, and is working to identify other French companies involved in order to alert them and prevent the spread. BFM TV reported that hackers managed to remotely trigger forced defrosting of refrigeration systems, altering temperatures and destroying stock.

What European operators should take from this

Industrial equipment that was once isolated from the internet is now routinely connected through sensors and remote monitoring, and this incident shows exactly how a single vendor vulnerability can cascade across hundreds of physical sites simultaneously. Every European business running connected building management, refrigeration, HVAC or industrial control systems should be asking which third party can remotely reach that equipment, whether those connections are monitored, and what the manual fallback is when the management layer is compromised. Vendor risk assessments for operational technology deserve the same rigour as any software dependency in your CI pipeline.

If your organisation needs help mapping third party access to your operational technology, hardening remote monitoring connections or building an incident response plan that covers physical equipment, contact Excello Digital at https://excello.digital/contact/. We help European companies secure the connected systems that keep their business running.