Major large-scale cyberattack on refrigeration and cold storage facilities in supermarkets and stores in France and stores in other countries including Portugal

 

 

A major, large-scale cyberattack hit hundreds of supermarkets across France—along with stores in several other European countries like Spain, Portugal, Belgium, and Germany—overnight from Sunday into Monday.

Here are the key details of what happened:

Instead of targeting financial databases, customer data, or stealing credit card details, the hackers targeted Operational Technology (OT)—specifically the centralized digital software and IoT control panels used to regulate refrigeration and freezer units.

• The “Defrost” Sabotage: Hackers remotely forced the equipment into extreme defrost cycles, cranking up temperatures in display cases and cold rooms to as high as 50°C (122°F) or more.
• Physical Damage: In addition to spoiling massive amounts of fresh and frozen food (meat, dairy, fish, and produce), the extreme and unexpected heating of the equipment caused a few localized fires and equipment burnout.

Major grocery chains across France reported widespread disruptions, including:

• Intermarché / Netto: Up to 150 to 200 stores affected.
• Coopérative U: Roughly 100 stores impacted, with leadership calling the attack “unprecedented” and completely unacceptable.
• Carrefour: Around 80 outlets hit.
• E. Leclerc and Monoprix: Also reported disruptions across a subset of their locations.

Read more

Compliled by Stephen R Davies with help from his trusty AI assistant

Total financial losses for certain individual stores ran into the hundreds of thousands of euros in ruined merchandise alone, forcing supermarkets to temporarily close specific aisles, dump mountains of spoiled food, and conduct heavy safety checks.

• The Culprit Vector: Initial technical indications point toward vulnerabilities in legacy or unpatched remote refrigeration controllers—specifically older software and hardware configurations (such as certain Danfoss/industrial controllers) that lacked adequate secure communication boundaries or were running outdated firmware.
• Official Action: France’s national cybersecurity agency, ANSSI, launched an immediate large-scale investigation alongside the Paris prosecutor’s office. Because the spillover affected multiple European nations, French authorities are closely coordinating with international counterparts.

The incident has sent shockwaves through the retail sector, serving as a stark wake-up call regarding the physical vulnerabilities of connecting critical supply-chain infrastructure and “smart” industrial appliances to the web.

Several major supermarket groups operating in Portugal utilize centralized or regionalized Operational Technology (OT) management networks for their store infrastructure:

• Intermarché Portugal: Operating under the Os Mosqueteiros group, Intermarché shares IT/OT frameworks with its French parent company. Certain stores running the compromised remote Danfoss controller software experienced forced defrost cycles, forcing Portuguese franchise managers to dispose of spoiled chilled and frozen inventory.
• Auchan / Carrefour Supply Networks: While direct store-level equipment hacks in Portugal were localized to specific facilities running vulnerable legacy firmware, multi-national chains faced immediate operational slowdowns while verifying and isolating their system controls to prevent further penetration.

Because the attack forced hundreds of distribution hubs and hypermarkets in France, Spain, and Belgium to dump massive quantities of perishable goods, fresh produce, dairy, and cold-chain logistics between France/Spain and Portugal were thrown into disarray:

• Import schedules for dairy, cold meats, and pre-packaged chilled goods arriving into Portugal from central European distribution hubs faced immediate delays or cancellations as suppliers scrambled to re-verify cold-chain integrity.

Portugal’s National Cybersecurity Center (CNCS – Centro Nacional de Cibersegurança) and local retail federations immediately issued high-priority advisories following the incident:

• OT Isolation Protocols: Portuguese commercial entities and food distribution warehouses using IoT-connected industrial refrigeration (e.g., Danfoss or Copeland controllers) were instructed to temporarily disconnect remote-management interfaces from the public internet.
• Urgent Firmware Audits: Tech teams across major Portuguese retailers (including Jerónimo Martins / Pingo Doce and Sonae / Continente) were forced into overnight security audits to ensure their cold-storage IoT hardware was patched and isolated behind secure VPN boundaries.